@brainervirus/workit-cli 8.6.1 → 8.8.0

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.6.1",
+    version: "8.8.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.6.1",
-      "@brainervirus/workit-cursor": "^8.6.1",
-      "@brainervirus/workit-opencode": "^8.6.1",
+      "@brainervirus/workit-core": "^8.8.0",
+      "@brainervirus/workit-cursor": "^8.8.0",
+      "@brainervirus/workit-opencode": "^8.8.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -15136,6 +15136,9 @@ function summarizeRow(row) {
     case "pr.created":
       summary = `#${row.pr ?? "?"} -> ${text("base")} at ${(row.head ?? "?").slice(0, 12)}${row.created === false ? " (existing)" : ""}`;
       break;
+    case "pr.status":
+      summary = `#${row.pr ?? "?"} ${text("state") && text("state") !== "open" ? `${text("state")} ` : ""}checks ${text("checks") || "?"} at ${(row.head ?? "?").slice(0, 12)}`;
+      break;
     case "pr.merged":
       summary = `#${row.pr ?? "?"} ${text("method")} at ${(row.head ?? "?").slice(0, 12)}${text("mergeSha") ? ` -> ${text("mergeSha").slice(0, 12)}` : ""}`;
       break;
@@ -63192,7 +63195,7 @@ function cursorHookDrift(installed, pluginDir) {
     if (pluginDir)
       commands.push(canonicalHookEntry(event, pluginDir).command);
     const entry = Array.isArray(list) ? list[0] : undefined;
-    if (!isRecord4(entry) || !commands.includes(entry.command) || entry.failClosed === true || event === "preToolUse" && entry.matcher !== canonical.matcher)
+    if (!isRecord4(entry) || !commands.includes(entry.command) || entry.failClosed === true || event === "stop" && entry.loop_limit !== canonical.loop_limit || event === "preToolUse" && entry.matcher !== canonical.matcher)
       drift.push(event);
   }
   return drift;
@@ -63215,7 +63218,11 @@ function cursorHooksEntry(pluginDir) {
 }
 var OPENCODE_NPM_PIN = "@brainervirus/workit-opencode", isRecord4 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest", cursorHookLauncher = (pluginDir) => pluginDir ? `node "${shellQuotedPath(path26.join(pluginDir, "hooks", "launch.mjs"))}"` : 'node "${CURSOR_PLUGIN_ROOT}/hooks/launch.mjs"', shellQuotedPath = (file) => path26.sep === "\\" ? file : file.replace(/([$`"\\])/g, "\\$1"), CURSOR_HOOK_RUN_COMMAND, CURSOR_PRETOOLUSE_MATCHER = "Write|Edit|Delete|Shell|Remove|ApplyPatch|Apply_Patch|Patch|Rename|Mkdir|Mv|Cp|Touch", CURSOR_HOOK_EVENTS, canonicalHookEntry = (event, pluginDir) => {
   const command = `${cursorHookLauncher(pluginDir)} workit-cursor-hook`;
-  return event === "preToolUse" ? { command, matcher: CURSOR_PRETOOLUSE_MATCHER, failClosed: false } : { command, failClosed: false };
+  if (event === "preToolUse")
+    return { command, matcher: CURSOR_PRETOOLUSE_MATCHER, failClosed: false };
+  if (event === "stop")
+    return { command, loop_limit: 1, failClosed: false };
+  return { command, failClosed: false };
 };
 var init_registration = __esm(() => {
   CURSOR_HOOK_RUN_COMMAND = `${cursorHookLauncher()} workit-cursor-hook`;
@@ -63224,6 +63231,7 @@ var init_registration = __esm(() => {
     "beforeShellExecution",
     "subagentStart",
     "subagentStop",
+    "stop",
     "preCompact"
   ];
 });
@@ -63932,11 +63940,13 @@ var init_skill_manifests = __esm(() => {
 
 // packages/workit-cli/src/admin/doctor.ts
 import { spawnSync as spawnSync13 } from "node:child_process";
+import { createHash as createHash13 } from "node:crypto";
 import {
   existsSync as existsSync13,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync5,
   mkdtempSync,
+  readdirSync as readdirSync7,
   readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   rmSync as rmSync2,
@@ -63977,8 +63987,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     cursorMcp: options.cursorMcp ?? path30.join(home, ".cursor", "mcp.json"),
     cursorPluginDir: options.cursorPluginDir ?? path30.join(home, ".cursor", "plugins", "local", "workit"),
     cursorHeartbeatDir: options.stateDir ?? (env.WORKFLOW_TOOLKIT_STATE || resolveStateDir()),
+    codexHome: options.codexHome,
+    piAgentDir: options.piAgentDir,
     env,
-    installer: options.installer ?? false
+    installer: options.installer ?? false,
+    cliVersion: options.cliVersion ?? null
   };
 }, readJson = (p) => {
   try {
@@ -64199,6 +64212,368 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     detail: `codex CLI ${installed} differs from the qualified ${qualified}`,
     fix: `Reinstall the qualified Codex CLI ${qualified} or record fresh qualification evidence`
   };
+}, readTomlTables = (file) => {
+  const tables = new Map;
+  let text;
+  try {
+    text = readFileSync13(file, "utf8");
+  } catch {
+    return tables;
+  }
+  const unquote = (raw) => {
+    const s = raw.trim();
+    if (s.startsWith('"')) {
+      try {
+        return JSON.parse(s);
+      } catch {
+        return s.slice(1, -1);
+      }
+    }
+    return s.startsWith("'") ? s.slice(1, -1) : s;
+  };
+  const SEGMENT = /\s*("(?:[^"\\]|\\.)*"|'[^']*'|[A-Za-z0-9_-]+)\s*(?:\.|$)/y;
+  let current = {};
+  tables.set("", current);
+  for (const line of text.split(/\r?\n/)) {
+    const header = /^\s*\[([^[\]]+)\]\s*(?:#.*)?$/.exec(line);
+    if (header) {
+      const parts = [];
+      SEGMENT.lastIndex = 0;
+      let match;
+      while (SEGMENT.lastIndex < header[1].length && (match = SEGMENT.exec(header[1])))
+        parts.push(unquote(match[1]));
+      const key = parts.join("\x00");
+      current = tables.get(key) ?? {};
+      tables.set(key, current);
+      continue;
+    }
+    const pair = /^\s*("(?:[^"\\]|\\.)*"|[A-Za-z0-9_-]+)\s*=\s*(.+?)\s*$/.exec(line);
+    if (!pair)
+      continue;
+    const value = pair[2].replace(/\s+#[^"']*$/, "");
+    current[unquote(pair[1])] = value === "true" ? true : value === "false" ? false : unquote(value);
+  }
+  return tables;
+}, codexHomeOf = (res) => res.codexHome ?? (res.env.CODEX_HOME || path30.join(res.home, ".codex")), codexWorkitInstalls = (res) => {
+  const codexHome = codexHomeOf(res);
+  const configFile = path30.join(codexHome, "config.toml");
+  const installs = [];
+  for (const [key, table] of readTomlTables(configFile)) {
+    const [kind, id, ...rest] = key.split("\x00");
+    if (kind !== "plugins" || rest.length > 0 || !id?.startsWith("workit@") || table.enabled === false)
+      continue;
+    const marketplace = id.slice("workit@".length);
+    const dir = path30.join(codexHome, "plugins", "cache", marketplace, "workit");
+    let versions = [];
+    try {
+      versions = readdirSync7(dir).filter((v) => existsSync13(path30.join(dir, v, ".codex-plugin")));
+    } catch {
+      versions = [];
+    }
+    const version = versions.reduce((best, v) => best && semverAtLeast(best, v) ? best : v, null);
+    installs.push({
+      id,
+      marketplace,
+      root: version ? path30.join(dir, version) : null,
+      version,
+      configFile
+    });
+  }
+  return installs;
+}, snakeEvent = (event) => event.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase(), codexHookHash = (event, matcher, handler) => {
+  if (handler.type !== "command" || typeof handler.command !== "string" || Object.keys(handler).some((k) => !["type", "command", "timeout", "async"].includes(k)))
+    return null;
+  const hook = {
+    async: handler.async ?? false,
+    command: handler.command,
+    timeout: handler.timeout ?? 600,
+    type: "command"
+  };
+  const body = {
+    event_name: snakeEvent(event),
+    hooks: [hook],
+    ...typeof matcher === "string" ? { matcher } : {}
+  };
+  return `sha256:${createHash13("sha256").update(JSON.stringify(body)).digest("hex")}`;
+}, codexHookTrust = (install, tables) => {
+  const hooks = install.root ? readJson(path30.join(install.root, "hooks", "hooks.json"))?.hooks : null;
+  if (!hooks || typeof hooks !== "object")
+    return null;
+  const result = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups))
+      continue;
+    groups.forEach((group, g) => {
+      const handlers = Array.isArray(group?.hooks) ? group.hooks : [];
+      handlers.forEach((handler, h) => {
+        const key = `${install.id}:hooks/hooks.json:${snakeEvent(event)}:${g}:${h}`;
+        const hash = codexHookHash(event, group?.matcher, handler ?? {});
+        const state = tables.get(["hooks", "state", key].join("\x00"));
+        const trusted = typeof state?.trusted_hash === "string" ? state.trusted_hash : null;
+        result.push({
+          key,
+          hash,
+          state: state?.enabled === false ? "disabled" : trusted === null ? "untrusted" : hash !== null && trusted !== hash ? "modified" : "trusted"
+        });
+      });
+    });
+  }
+  return result;
+}, checkCodexHooks = (res) => {
+  const installs = codexWorkitInstalls(res);
+  if (installs.length === 0)
+    return {
+      id: "codex_hooks",
+      status: "pass",
+      detail: "no Workit Codex plugin enabled — skipping"
+    };
+  const tables = readTomlTables(installs[0].configFile);
+  const problems = [];
+  const toTrust = [];
+  let reinstall;
+  let total = 0;
+  for (const install of installs) {
+    const trust = codexHookTrust(install, tables);
+    if (!trust) {
+      problems.push(`${install.id}: no installed hooks/hooks.json`);
+      reinstall ??= `codex plugin remove ${install.id} && codex plugin add ${install.id}`;
+      continue;
+    }
+    total += trust.length;
+    for (const state of ["untrusted", "modified", "disabled"]) {
+      const hit = trust.filter((t) => t.state === state);
+      if (hit.length > 0)
+        problems.push(`${install.id}: ${hit.length} of ${trust.length} hooks ${state === "modified" ? "changed since trusted" : state} (${hit.map((t) => t.key.split(":")[2]).join(", ")})`);
+    }
+    toTrust.push(...trust.filter((t) => t.state !== "trusted"));
+  }
+  if (problems.length === 0)
+    return {
+      id: "codex_hooks",
+      status: "pass",
+      detail: `${total} Workit Codex plugin hooks trusted (${installs.map((i) => `${i.id} ${i.version ?? "?"}`).join(", ")})`
+    };
+  const disabled = toTrust.some((t) => t.state === "disabled");
+  const fix = reinstall ?? `Start \`codex\`, run \`/hooks\` and ${disabled ? "enable and " : ""}trust the workit hooks (or pick "Trust all and continue" when Codex asks you to review hooks at startup)`;
+  return {
+    id: "codex_hooks",
+    status: "warn",
+    detail: `Codex skips untrusted plugin hooks — ${problems.join("; ")}`,
+    fix
+  };
+}, CODEX_AGENT_MARKER = "# Generated by Workit", AGENT_MARKER_VERSION, agentMarkerVersion = (text) => AGENT_MARKER_VERSION.exec(text)?.[1] ?? null, stampCodexAgent = (content, version) => version && content.startsWith(CODEX_AGENT_MARKER) && !agentMarkerVersion(content) ? `${CODEX_AGENT_MARKER} ${version}${content.slice(CODEX_AGENT_MARKER.length)}` : content, checkCodexAgents = (res) => {
+  const installs = codexWorkitInstalls(res);
+  if (installs.length === 0)
+    return {
+      id: "codex_agents",
+      status: "pass",
+      detail: "no Workit Codex plugin enabled — skipping"
+    };
+  const agentsDir = path30.join(codexHomeOf(res), "agents");
+  const problems = [];
+  const fixes = [];
+  const installed = [];
+  for (const install of installs) {
+    const source = install.root ? path30.join(install.root, "agents") : null;
+    const files = source && existsSync13(source) ? readdirSync7(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
+    if (files.length === 0) {
+      problems.push(`${install.id} ${install.version ?? "?"} bundles no agents`);
+      fixes.push(`codex plugin remove ${install.id} && codex plugin add ${install.id}`);
+      continue;
+    }
+    const install_fix = `node ${JSON.stringify(path30.join(install.root, "dist", "launch-mcp.js"))} --install-agents, then start a new Codex session`;
+    const pluginVersion = readJson(path30.join(install.root, "package.json"))?.version;
+    const version = typeof pluginVersion === "string" ? pluginVersion.match(SEMVER)?.[0] ?? null : null;
+    let stale = false;
+    for (const file of files) {
+      const dest = path30.join(agentsDir, file);
+      const want = stampCodexAgent(readFileSync13(path30.join(source, file), "utf8"), version);
+      let link = false;
+      try {
+        link = lstatSync4(dest).isSymbolicLink();
+      } catch {
+        link = false;
+      }
+      if (link) {
+        problems.push(`${dest} is a symlink (the plugin never writes through one)`);
+        fixes.push(`replace the symlink ${dest} with a file or remove it, then run ${install_fix}`);
+        continue;
+      }
+      let have = null;
+      try {
+        have = readFileSync13(dest, "utf8");
+      } catch {
+        have = null;
+      }
+      const written = have === null ? null : agentMarkerVersion(have);
+      const newer = written !== null && version !== null && versionBehind(version, written);
+      if (have === want || newer) {
+        installed.push(file.replace(/\.toml$/, ""));
+        continue;
+      }
+      if (have !== null && !have.startsWith(CODEX_AGENT_MARKER)) {
+        problems.push(`${dest} is a user agent that shadows ${install.id}'s ${file}`);
+        fixes.push(`rename or remove ${dest}, then run ${install_fix}`);
+        continue;
+      }
+      problems.push(`${dest} ${have === null ? "missing" : "outdated"}`);
+      stale = true;
+    }
+    if (stale)
+      fixes.push(install_fix);
+  }
+  if (problems.length === 0)
+    return {
+      id: "codex_agents",
+      status: "pass",
+      detail: `Codex agents ${installed.join(", ")} installed in ${agentsDir}`
+    };
+  return {
+    id: "codex_agents",
+    status: "warn",
+    detail: problems.join("; "),
+    fix: [...new Set(fixes)].join("; ")
+  };
+}, PI_PACKAGE = "@brainervirus/workit-pi", PI_EXTENSION = "dist/workit.js", piAgentDirOf = (res) => {
+  if (res.piAgentDir)
+    return res.piAgentDir;
+  const env = res.env.PI_CODING_AGENT_DIR;
+  if (env)
+    return env === "~" ? res.home : env.replace(/^~(?=\/|\\)/, res.home);
+  return path30.join(res.home, ".pi", "agent");
+}, npmSpecName = (spec) => {
+  const at = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
+  return at > 0 ? { name: spec.slice(0, at), pinned: true } : { name: spec, pinned: false };
+}, findPiEntry = (res, agentDir) => {
+  const scopes = [
+    {
+      scope: "project",
+      settingsFile: path30.join(res.cwd, ".pi", "settings.json"),
+      base: path30.join(res.cwd, ".pi")
+    },
+    { scope: "user", settingsFile: path30.join(agentDir, "settings.json"), base: agentDir }
+  ];
+  for (const { scope, settingsFile, base } of scopes) {
+    const packages = readJson(settingsFile)?.packages;
+    if (!Array.isArray(packages))
+      continue;
+    for (const entry of packages) {
+      const source = typeof entry === "string" ? entry : typeof entry?.source === "string" ? entry.source : null;
+      if (!source)
+        continue;
+      const filter = typeof entry === "object" ? entry : null;
+      if (source.startsWith("npm:")) {
+        const spec = npmSpecName(source.slice(4).trim());
+        if (spec.name !== PI_PACKAGE)
+          continue;
+        const root = path30.join(base, "npm", "node_modules", ...PI_PACKAGE.split("/"));
+        return { scope, settingsFile, source, filter, root, npm: { pinned: spec.pinned } };
+      }
+      if (/^(git:|https?:|ssh:|git@)/.test(source))
+        continue;
+      const local = path30.resolve(base, source.replace(/^~(?=\/|\\)/, res.home));
+      if (readJson(path30.join(local, "package.json"))?.name === PI_PACKAGE)
+        return { scope, settingsFile, source, filter, root: local, npm: null };
+    }
+  }
+  return null;
+}, globToRegExp3 = (pattern) => new RegExp(`^${pattern.replace(/^\.\//, "").replace(/[.+^${}()|[\]\\]/g, "\\$&").split(/\*\*\/?/).map((part) => part.replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")).join(".*")}$`), piFilterKeeps = (patterns, file) => {
+  if (!Array.isArray(patterns))
+    return true;
+  const list = patterns.filter((p) => typeof p === "string");
+  if (list.length === 0)
+    return false;
+  const name = path30.posix.basename(file);
+  const matches = (p) => {
+    const re = globToRegExp3(p);
+    return re.test(file) || re.test(name);
+  };
+  const exact = (p) => p.replace(/^\.\//, "") === file;
+  const includes = list.filter((p) => !/^[!+-]/.test(p));
+  let kept = includes.length === 0 || includes.some(matches);
+  if (list.some((p) => p.startsWith("!") && matches(p.slice(1))))
+    kept = false;
+  if (list.some((p) => p.startsWith("+") && exact(p.slice(1))))
+    kept = true;
+  if (list.some((p) => p.startsWith("-") && exact(p.slice(1))))
+    kept = false;
+  return kept;
+}, checkPiExtension = (res) => {
+  const agentDir = piAgentDirOf(res);
+  if (!existsSync13(agentDir) && !commandOnPath("pi", res.env))
+    return { id: "pi_extension", status: "pass", detail: "Pi not installed — skipping" };
+  const installCmd = (scope, spec = `npm:${PI_PACKAGE}`) => `pi install ${spec}${scope === "project" ? " -l" : ""}`;
+  const entry = findPiEntry(res, agentDir);
+  if (!entry)
+    return {
+      id: "pi_extension",
+      status: "warn",
+      detail: `Workit Pi extension missing: no ${PI_PACKAGE} entry in ${path30.join(agentDir, "settings.json")} or ${path30.join(res.cwd, ".pi", "settings.json")}`,
+      fix: installCmd("user")
+    };
+  const where = `${entry.source} (${entry.scope}, ${entry.settingsFile})`;
+  const rebuild = `cd ${JSON.stringify(entry.root)} && bun run build`;
+  const pkg = readJson(path30.join(entry.root, "package.json"));
+  if (!pkg)
+    return {
+      id: "pi_extension",
+      status: "warn",
+      detail: `Workit Pi extension missing: ${where} is listed but not installed at ${entry.root}`,
+      fix: entry.npm ? installCmd(entry.scope, entry.source) : `restore ${entry.root}, then ${rebuild}`
+    };
+  const declared = Array.isArray(pkg.pi?.extensions) ? pkg.pi.extensions.some((e) => typeof e === "string" && e.replace(/^\.\//, "") === PI_EXTENSION) : false;
+  if (!declared || !existsSync13(path30.join(entry.root, PI_EXTENSION)))
+    return {
+      id: "pi_extension",
+      status: "warn",
+      detail: `Workit Pi extension not loading: ${entry.root} ${declared ? `has no ${PI_EXTENSION}` : `does not declare ${PI_EXTENSION} in its pi manifest`}`,
+      fix: entry.npm ? `pi remove ${entry.source}${entry.scope === "project" ? " -l" : ""} && ${installCmd(entry.scope, entry.source)}` : rebuild
+    };
+  const filter = entry.filter?.extensions;
+  if (!piFilterKeeps(filter, PI_EXTENSION))
+    return {
+      id: "pi_extension",
+      status: "warn",
+      detail: `Workit Pi extension not loading: the ${PI_PACKAGE} entry in ${entry.settingsFile} filters out ${PI_EXTENSION} (extensions: ${JSON.stringify(filter)})`,
+      fix: `remove the "extensions" filter from the ${PI_PACKAGE} entry in ${entry.settingsFile}, or enable the extension with \`pi config${entry.scope === "project" ? " -l" : ""}\``
+    };
+  const version = typeof pkg.version === "string" ? pkg.version : null;
+  const cli = res.cliVersion;
+  if (version && cli && versionBehind(version, cli)) {
+    if (!entry.npm)
+      return {
+        id: "pi_extension",
+        status: "pass",
+        detail: `Workit Pi extension ${version} from local checkout ${where} loads ${PI_EXTENSION} (older than workit ${cli}; a checkout is not compared with the registry)`
+      };
+    const latest = registryLatestVersion(res, PI_PACKAGE);
+    const registryProbed = latest !== null && !res.env.WORKIT_DOCTOR_STALE_REGISTRY_VERSION;
+    if (!latest)
+      return {
+        id: "pi_extension",
+        status: "pass",
+        detail: `Workit Pi extension ${version} from ${where} loads ${PI_EXTENSION}; registry unreachable, so whether a version newer than ${version} is published is unknown (workit ${cli})`
+      };
+    if (versionBehind(version, latest))
+      return {
+        id: "pi_extension",
+        status: "warn",
+        detail: `Workit Pi extension stale: ${PI_PACKAGE} ${version} from ${where} is older than workit ${cli} (published ${latest})`,
+        fix: entry.npm.pinned ? installCmd(entry.scope, `npm:${PI_PACKAGE}@${latest}`) : `pi update npm:${PI_PACKAGE}`,
+        registryProbed
+      };
+    return {
+      id: "pi_extension",
+      status: "pass",
+      detail: `Workit Pi extension ${version} from ${where} is the newest published (workit ${cli})`,
+      registryProbed
+    };
+  }
+  return {
+    id: "pi_extension",
+    status: "pass",
+    detail: `Workit Pi extension ${version ?? "?"} from ${where} loads ${PI_EXTENSION}`
+  };
 }, assetPathsFor = (host, dev) => {
   const pkg = path30.join(dev, "packages", `workit-${host}`);
   switch (host) {
@@ -65306,6 +65681,7 @@ var init_doctor = __esm(() => {
   init_host_install();
   init_skill_manifests();
   OPENCODE_V1_FIX = `OpenCode < ${SUPPORT_MATRIX.opencode.minimum} cannot load Workit 3 (V2 plugin API only): upgrade OpenCode to ${SUPPORT_MATRIX.opencode.minimum}+, or stay on Workit 2.x by pinning "@brainervirus/workit-opencode@2" in the opencode.json "plugin" array`;
+  AGENT_MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
   canonicalCursorHook = cursorHooksEntry().command;
   SILENT_HOOK_GRACE_MS = 2 * 60000;
   SEMVER = /\d+\.\d+\.\d+/;
@@ -65314,6 +65690,9 @@ var init_doctor = __esm(() => {
     checkRuntime,
     checkVersions,
     checkCodexPin,
+    checkCodexHooks,
+    checkCodexAgents,
+    checkPiExtension,
     checkOpencodeVersion,
     checkClaudePlugin,
     checkWorkitOnPath,
@@ -65353,7 +65732,7 @@ import {
   mkdirSync as mkdirSync6,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync14,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync8,
   realpathSync as realpathSync7,
   renameSync as renameSync3,
   rmSync as rmSync3,
@@ -66239,7 +66618,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, samePluginContent = (src, dest, pluginDir, relative = "") => {
   try {
-    for (const entry of readdirSync7(src, { withFileTypes: true })) {
+    for (const entry of readdirSync8(src, { withFileTypes: true })) {
       if (entry.name === "node_modules")
         continue;
       const source = path31.join(src, entry.name);
@@ -66254,7 +66633,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
           return false;
       }
     }
-    for (const entry of readdirSync7(dest, { withFileTypes: true })) {
+    for (const entry of readdirSync8(dest, { withFileTypes: true })) {
       if (existsSync14(path31.join(src, entry.name)))
         continue;
       const rel = path31.join(relative, entry.name);
@@ -66273,7 +66652,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   const sourceRules = path31.join(src, "rules");
   const installedRules = path31.join(dest, "rules");
   try {
-    for (const entry of readdirSync7(installedRules, { withFileTypes: true })) {
+    for (const entry of readdirSync8(installedRules, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".mdc"))
         continue;
       if (existsSync14(path31.join(sourceRules, entry.name)))
@@ -66290,7 +66669,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   if (existsSync14(legacyRules)) {
     try {
       mkdirSync6(path31.join(res.cursorPluginDir, "rules"), { recursive: true });
-      for (const entry of readdirSync7(legacyRules, { withFileTypes: true })) {
+      for (const entry of readdirSync8(legacyRules, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".mdc"))
           continue;
         const target = path31.join(res.cursorPluginDir, "rules", entry.name);
@@ -70082,7 +70461,7 @@ import {
 } from "node:fs";
 import path35 from "node:path";
 import os12 from "node:os";
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 function previewUpgrade(hosts = HOSTS2, deps = {}) {
   const paths = upgradePaths(deps);
   const { home, configDir } = paths;
@@ -70210,7 +70589,7 @@ function applyUpgrade(plan, deps = {}) {
   mkdirSync8(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
     if (existsSync17(file)) {
-      const target = path35.join(backup, createHash13("sha256").update(file).digest("hex").slice(0, 12) + "-" + path35.basename(file));
+      const target = path35.join(backup, createHash14("sha256").update(file).digest("hex").slice(0, 12) + "-" + path35.basename(file));
       copyFileSync5(file, target);
       chmodSync(target, 384);
     }
@@ -70465,7 +70844,7 @@ var HOSTS2, upgradePaths = (deps) => {
   if (!data || typeof data !== "object" || Array.isArray(data))
     throw new Error(`${file} is not a configuration object`);
   return data;
-}, digest2 = (file) => existsSync17(file) ? createHash13("sha256").update(readFileSync17(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
+}, digest2 = (file) => existsSync17(file) ? createHash14("sha256").update(readFileSync17(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
   const { home, env } = upgradePaths(deps);
   let step;
   try {
@@ -70951,7 +71330,12 @@ async function run5(argv, io) {
     }
     fixLock = clearStaleMetadataLock(root, { force });
   }
-  const report = runDoctor({ host: "cli", cwd: io.cwd, workspaceRoot: root });
+  const report = runDoctor({
+    host: "cli",
+    cwd: io.cwd,
+    workspaceRoot: root,
+    cliVersion: package_default.version
+  });
   let knowledge = null;
   try {
     knowledge = lintKnowledge(root);
@@ -70984,7 +71368,9 @@ async function run5(argv, io) {
     io.stdout(`${mark} ${check.id} — ${check.detail}
 `);
     if (check.fix)
-      io.stdout(`     fix: ${check.fix}
+      io.stdout(`     fix: ${check.fix.replaceAll(`
+`, `
+          `)}
 `);
   }
   io.stdout(`${knowledgeLine}
@@ -70994,6 +71380,7 @@ async function run5(argv, io) {
   return report.exitCode;
 }
 var init_doctor2 = __esm(() => {
+  init_package();
   init_doctor();
   init_knowledge();
   init_store_lock();
@@ -71107,7 +71494,7 @@ var init_redact = __esm(() => {
 
 // packages/workit-core/src/checks.ts
 import { spawn, spawnSync as spawnSync16 } from "node:child_process";
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 import fs18 from "node:fs";
 import os13 from "node:os";
 import path37 from "node:path";
@@ -71441,7 +71828,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   return report;
 }
-var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash14("sha256").update(log).digest("hex")}`, LOG_RETENTION;
+var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash15("sha256").update(log).digest("hex")}`, LOG_RETENTION;
 var init_checks3 = __esm(() => {
   init_redact();
   MAX_LOG_BYTES = 2 * 1024 * 1024;
@@ -72916,6 +73303,33 @@ function buildStatusDoc(cwd, resolved, status, options) {
     babysit: babysitAction(blockers[0]?.next ?? "READY", blockers[0]?.reason ?? null, status.draft || blockers.some((blocker) => blocker.next === "MARK_READY"))
   });
 }
+function recordPrStatus(cwd, doc, actor) {
+  const checks = doc.checks.state;
+  const state = doc.state;
+  if (state !== "open" && state !== "merged" && state !== "closed")
+    return;
+  if (state === "open" && checks !== "passing" && checks !== "failing" && checks !== "pending")
+    return;
+  try {
+    const ledger = readLedger(cwd);
+    if (!ledger.ok)
+      return;
+    const last = ledger.value.rows.findLast((row) => row.type === "pr.status" && row.observer === "workit_cli" && row.pr === doc.number && row.repo === doc.repo);
+    if (last && last.head === doc.head.sha && last.checks === checks && (last.state ?? "open") === state)
+      return;
+    appendObserved(cwd, {
+      type: "pr.status",
+      actor,
+      branch: doc.head.branch,
+      head: doc.head.sha,
+      pr: doc.number,
+      repo: doc.repo,
+      forge: doc.forge,
+      state,
+      checks
+    });
+  } catch {}
+}
 function prStatusReport(cwd, resolved, options = {}) {
   const number = selectPr(cwd, resolved, options);
   if (!number.ok)
@@ -72930,6 +73344,8 @@ function prStatusReport(cwd, resolved, options = {}) {
   });
   if (!doc.ok)
     return doc;
+  if (options.actor)
+    recordPrStatus(cwd, doc.data, options.actor);
   return success2({ doc: doc.data, raw: status.data });
 }
 function waitVerdict(doc, options) {
@@ -73055,6 +73471,7 @@ function recordAccepted(cwd, resolved, status, accepted, options) {
 var MAX_LOG_TAILS = 5, GITLAB_MERGEABLE, GITHUB_MERGEABLE, NO_CHECKS_GRACE_MS = 90000;
 var init_report = __esm(() => {
   init_rev();
+  init_ledger();
   init_reruns();
   GITLAB_MERGEABLE = new Set(["mergeable"]);
   GITHUB_MERGEABLE = new Set(["clean", "unstable", "has_hooks"]);
@@ -73426,7 +73843,7 @@ var init_pr_ops = __esm(() => {
 
 // packages/workit-core/src/stack.ts
 import { spawnSync as spawnSync19 } from "node:child_process";
-import { createHash as createHash15, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash16, randomBytes as randomBytes3 } from "node:crypto";
 import fs20 from "node:fs";
 import path41 from "node:path";
 function worktreeOf(cwd, branch) {
@@ -74593,7 +75010,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return dir.ok ? path41.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
-`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash15("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
+`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash16("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
   if (name.length === 0 || name.length > 200)
     return false;
   for (let index = 0;index < name.length; index += 1) {
@@ -76216,7 +76633,8 @@ async function status(argv, io) {
     pr,
     branch: flags.values.branch ?? null,
     logLines: logLines ?? 60,
-    identity: connected.data.identity
+    identity: connected.data.identity,
+    actor: actorFromEnv(io.env)
   });
   if (!report.ok)
     return forgeFail(io, report);
@@ -76587,6 +77005,7 @@ async function wait(argv, io) {
   const number = selectPr(io.cwd, resolved, { pr, branch: flags.values.branch ?? null });
   if (!number.ok)
     return forgeFail(io, number);
+  const actor = actorFromEnv(io.env);
   let polls = 0;
   let errors = 0;
   let status = null;
@@ -76601,6 +77020,7 @@ async function wait(argv, io) {
       const doc = buildStatusDoc(io.cwd, resolved, status, { logLines: 0, behind: false });
       if (!doc.ok)
         return forgeFail(io, doc);
+      recordPrStatus(io.cwd, doc.data, actor);
       verdict = waitVerdict(doc.data, { head, elapsedMs });
       if (verdict.state !== "waiting")
         break;
@@ -76727,6 +77147,7 @@ async function run11(argv, io) {
 var WAIT_USAGE = "workit ci wait [--pr <n> | --branch <b>] [--head <sha>] [--timeout 20m] [--interval 30s] [--json]", RERUN_USAGE = "workit ci rerun [--pr <n> | --branch <b>] [--check <name>… | --failed] --reason flake|infra [--force] [--json]", ONE_POLL_MS = 20000, MAX_POLL_ERRORS = 3, seconds = (ms) => `${Math.round(ms / 1000)}s`;
 var init_ci = __esm(() => {
   init_report();
+  init_ledger();
   init_autonomy();
   init_output();
   init_forge_common();
@@ -77522,7 +77943,7 @@ var init_stack2 = __esm(() => {
 
 // packages/workit-core/src/fanout.ts
 import { spawnSync as spawnSync23 } from "node:child_process";
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import fs23 from "node:fs";
 import path45 from "node:path";
 function expandBraces(pattern, limit = 64) {
@@ -78003,7 +78424,7 @@ function sliceHash(slice) {
     context: _context,
     ...definition
   } = slice;
-  return createHash16("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
+  return createHash17("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
 }
 function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
@@ -78708,13 +79129,13 @@ var init_fanout_worktree = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-brief.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 function workerSession(lead, slice, attempt) {
   const tail = attempt === null ? "" : `+try${attempt}`;
   const full = `${lead}-w-${slice}${tail}`;
   if (full.length <= SESSION_MAX)
     return full;
-  const digest = createHash17("sha256").update(slice).digest("hex").slice(0, 12);
+  const digest = createHash18("sha256").update(slice).digest("hex").slice(0, 12);
   return `${lead.slice(0, SESSION_MAX - 3 - digest.length - tail.length)}-w-${digest}${tail}`;
 }
 function renderBrief(cwd, plan, input) {
@@ -95900,7 +96321,7 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync25 } from "node:child_process";
-import { existsSync as existsSync19, readdirSync as readdirSync8, readFileSync as readFileSync22, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync19, readdirSync as readdirSync9, readFileSync as readFileSync22, statSync as statSync7 } from "node:fs";
 import path49 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync25("git", ["-c", "core.quotepath=off", ...args], {
@@ -95911,7 +96332,7 @@ function git7(cwd, args) {
   return { ok: run.status === 0, stdout: run.stdout ?? "" };
 }
 function walkTests(dir, out) {
-  for (const entry of readdirSync8(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync9(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
     const full = path49.join(dir, entry.name);
@@ -96047,7 +96468,7 @@ import {
   lstatSync as lstatSync7,
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync4,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   readFileSync as readFileSync23,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync9,
@@ -96144,7 +96565,7 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
-    names = readdirSync9(tmp);
+    names = readdirSync10(tmp);
   } catch {
     return 0;
   }
@@ -96173,7 +96594,7 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
 }
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync9(target, { recursive: true });
-  for (const entry of readdirSync9(origin, { withFileTypes: true })) {
+  for (const entry of readdirSync10(origin, { withFileTypes: true })) {
     const from = path50.join(origin, entry.name);
     const to = path50.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.6.1",
+  "version": "8.8.0",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,9 +38,9 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-core": "^8.6.1",
-    "@brainervirus/workit-cursor": "^8.6.1",
-    "@brainervirus/workit-opencode": "^8.6.1",
+    "@brainervirus/workit-core": "^8.8.0",
+    "@brainervirus/workit-cursor": "^8.8.0",
+    "@brainervirus/workit-opencode": "^8.8.0",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"