@brainervirus/workit-cli 8.8.0 → 8.9.0

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.8.0",
+    version: "8.9.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.8.0",
-      "@brainervirus/workit-cursor": "^8.8.0",
-      "@brainervirus/workit-opencode": "^8.8.0",
+      "@brainervirus/workit-core": "^8.9.0",
+      "@brainervirus/workit-cursor": "^8.9.0",
+      "@brainervirus/workit-opencode": "^8.9.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -63938,30 +63938,353 @@ var init_skill_manifests = __esm(() => {
   if (false) {}
 });
 
-// packages/workit-cli/src/admin/doctor.ts
+// packages/workit-core/src/git/session-hook.ts
 import { spawnSync as spawnSync13 } from "node:child_process";
-import { createHash as createHash13 } from "node:crypto";
 import {
+  chmodSync,
   existsSync as existsSync13,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync5,
-  mkdtempSync,
-  readdirSync as readdirSync7,
   readFileSync as readFileSync13,
-  readlinkSync as readlinkSync2,
+  renameSync as renameSync3,
   rmSync as rmSync2,
   statSync as statSync4,
-  unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import os8 from "node:os";
 import path30 from "node:path";
+function inspectSessionHook(cwd, env = process.env) {
+  const none = { hooksDir: null, hookPath: null, helperPath: null, helperCurrent: false };
+  if (!existsSync13(cwd))
+    return { state: "not_git", ...none };
+  const top = run2(cwd, ["rev-parse", "--show-toplevel"], env);
+  if (!top.ok || !top.out)
+    return { state: "not_git", ...none };
+  const paths = run2(cwd, ["rev-parse", "--path-format=absolute", "--git-common-dir", "--git-path", "hooks"], env);
+  const [commonDir, hooksDir] = paths.out.split(/\r?\n/);
+  if (!paths.ok || !commonDir || !hooksDir)
+    return { state: "not_git", ...none };
+  const hookPath = path30.join(hooksDir, SESSION_HOOK_NAME);
+  const helperPath = path30.join(commonDir, ...HELPER);
+  const helperCurrent = readText(helperPath) === SESSION_TRAILER_SCRIPT;
+  const leftover = leftoverOf(hooksDir);
+  const base = { hooksDir, hookPath, helperPath, helperCurrent, ...leftover ? { leftover } : {} };
+  const blocked = (reason, owner, text = "") => {
+    const old = `${hookPath}.old`;
+    const displaced = readText(old)?.includes(SESSION_HOOK_MARKER) ? old : null;
+    const input = { owner, text, hooksDir, hookPath, top: top.out, displaced };
+    const manualTarget = manualTargetOf(input);
+    const owned = text ? { owner } : {};
+    if (manualInPlace(input, manualTarget))
+      return {
+        state: "manual",
+        ...base,
+        ...owned,
+        manualTarget,
+        via: owner === "other" ? "existing hook" : owner
+      };
+    return {
+      state: "blocked",
+      ...base,
+      ...owned,
+      reason: displaced ? `${reason} (Workit's earlier hook was moved to ${old})` : reason,
+      manual: manualFor(input),
+      manualTarget
+    };
+  };
+  if (!inside2(hooksDir, commonDir) && !inside2(hooksDir, top.out))
+    return blocked(`core.hooksPath ${hooksDir} is outside the repository; a hook there runs in every repository that uses it`, "other");
+  const text = exists(hookPath) ? readText(hookPath) ?? "" : null;
+  if (text !== null) {
+    if (text === SESSION_HOOK_SCRIPT)
+      return { state: helperCurrent ? "installed" : "outdated", ...base };
+    if (text.includes(SESSION_HOOK_MARKER))
+      return { state: "outdated", ...base };
+    const owner = ownerOf(text, hooksDir, top.out);
+    return blocked(`${hookPath} belongs to ${owner === "other" ? "another hook" : owner}; Workit never replaces it`, owner, text);
+  }
+  if (!inside2(hooksDir, commonDir)) {
+    const rel = path30.relative(top.out, hookPath).split(path30.sep).join("/");
+    if (!run2(top.out, ["check-ignore", "-q", "--", rel], env).ok)
+      return blocked(`${hooksDir} is in the working tree and not ignored; the hook would show up as a new file`, "other");
+  }
+  return { state: "missing", ...base };
+}
+function installSessionHook(cwd, env = process.env) {
+  const status = inspectSessionHook(cwd, env);
+  if (status.state === "not_git")
+    return {
+      action: "skipped",
+      helperWritten: false,
+      status,
+      detail: "not inside a git work tree"
+    };
+  const helperWritten = !status.helperCurrent;
+  if (helperWritten)
+    writeExecutable(status.helperPath, SESSION_TRAILER_SCRIPT);
+  const helper = helperWritten ? `; wrote ${status.helperPath}` : "";
+  if (status.state === "installed")
+    return {
+      action: "unchanged",
+      helperWritten,
+      status,
+      detail: `hook already at ${status.hookPath}`
+    };
+  if (status.state === "manual")
+    return {
+      action: "unchanged",
+      helperWritten,
+      status: inspectSessionHook(cwd, env),
+      detail: `${status.manualTarget} already runs the helper (via ${status.via})${helper}`
+    };
+  if (status.state === "blocked")
+    return {
+      action: "skipped",
+      helperWritten,
+      status: inspectSessionHook(cwd, env),
+      detail: `${status.reason}${helper}`
+    };
+  const fresh = status.state === "missing";
+  const slotCurrent = readText(status.hookPath) === SESSION_HOOK_SCRIPT;
+  if (!slotCurrent)
+    writeExecutable(status.hookPath, SESSION_HOOK_SCRIPT);
+  const verb = fresh ? "installed" : "updated";
+  return {
+    action: verb,
+    helperWritten,
+    status: inspectSessionHook(cwd, env),
+    detail: `${verb} the Workit ${SESSION_HOOK_NAME} hook at ${status.hookPath}${helper}`
+  };
+}
+var SESSION_HOOK_NAME = "prepare-commit-msg", SESSION_HOOK_MARKER = "# workit-session-trailer-hook", HELPER, LEGACY_CHAINED = "commit-msg.workit-chained", SESSION_TRAILER_SCRIPT = `#!/bin/sh
+# Workit (https://github.com/BrainerVirus/workit) wrote this file with
+# \`workit doctor --fix\`. A prepare-commit-msg hook runs it with its own
+# arguments to add a Workit-Session trailer to commits made in an agent session.
+# Not a hook itself; delete it together with the line that runs it.
+# lefthook passes a missing argument as its literal placeholder.
+case "\${2-}" in "" | "{2}" | template) exit 0 ;; esac
+gitdir=$(git rev-parse --git-dir) || exit 0
+if [ -d "$gitdir/rebase-merge" ] || [ -d "$gitdir/rebase-apply" ] || [ -f "$gitdir/CHERRY_PICK_HEAD" ]; then
+  exit 0
+fi
+trim() { printf '%s' "$1" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//'; }
+inner=$(trim "\${OPENCODE_SESSION_ID-}"); inner_host=opencode
+if [ -z "$inner" ]; then inner=$(trim "\${PI_SESSION_ID-}"); inner_host=pi; fi
+if [ -z "$inner" ]; then inner=$(trim "\${CODEX_THREAD_ID-}"); inner_host=codex; fi
+[ -n "$inner" ] || inner_host=
+declared=$(trim "\${WORKIT_HOST-}")
+family=$(printf '%s' "$declared" | sed 's/_cli$//;s/_desktop$//')
+session=$inner
+if [ "\${WORKIT_SESSION_ID+set}" = set ]; then
+  if [ -z "$inner" ] || [ -z "$declared" ] || [ "$family" = "$inner_host" ]; then
+    session=$(trim "$WORKIT_SESSION_ID")
+  fi
+fi
+[ -n "$session" ] || exit 0
+[ \${#session} -le 128 ] || exit 0
+case "$session" in *[!A-Za-z0-9_.:@/+-]*) exit 0 ;; esac
+add_trailer() {
+  [ -f "$1" ] && [ -r "$1" ] || return 0
+  body=$(sed '/^# -\\{24\\} >8 -\\{24\\}$/,$d' "$1" | git stripspace --strip-comments)
+  [ -n "$body" ] || return 0
+  # A merge message has no final newline; interpret-trailers would glue the
+  # trailer to the subject line.
+  [ -z "$(tail -c 1 "$1")" ] || printf '\\n' >> "$1"
+  git -c trailer.separators=: -c trailer.where=end interpret-trailers --in-place \\
+    --no-divider --if-exists addIfDifferent --trailer "Workit-Session: $session" "$1" || return 0
+}
+# $1 is the message file. lefthook cannot quote a path it pastes in, so its
+# job passes '' and the file is found here: git hands the hook COMMIT_EDITMSG,
+# except \`git merge\`, which hands it MERGE_MSG. With source "merge" both are
+# updated: the one git did not hand over is stale or removed after the commit.
+case "\${1-}" in "" | "{1}") ;; *) add_trailer "$1"; exit 0 ;; esac
+add_trailer "$(git rev-parse --git-path COMMIT_EDITMSG)"
+[ "$2" != merge ] || add_trailer "$(git rev-parse --git-path MERGE_MSG)"
+exit 0
+`, manualTrailerLine = () => `h="$(git rev-parse --git-common-dir 2>/dev/null)/${HELPER.join("/")}"; [ ! -f "$h" ] || sh "$h" "$@" || true`, lefthookTrailerRun = () => `set -f; IFS=; h=$(git rev-parse --git-common-dir 2>/dev/null)/${HELPER.join("/")}; [ ! -f $h ] || sh $h '' {2} {3} || true`, HELPER_REF, SESSION_HOOK_SCRIPT, run2 = (cwd, args, env) => {
+  const r = spawnSync13("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: GIT_TIMEOUTS.local,
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...env, GIT_TERMINAL_PROMPT: "0" }
+  });
+  return { ok: r.status === 0, out: (r.stdout ?? "").trim() };
+}, inside2 = (child, parent) => {
+  const rel = path30.relative(path30.resolve(parent), path30.resolve(child));
+  return rel === "" || !rel.startsWith("..") && !path30.isAbsolute(rel);
+}, readText = (file) => {
+  try {
+    return readFileSync13(file, "utf8");
+  } catch {
+    return null;
+  }
+}, exists = (file) => {
+  try {
+    lstatSync4(file);
+    return true;
+  } catch {
+    return false;
+  }
+}, LEFTHOOK_CONFIGS, lefthookConfig = (top) => LEFTHOOK_CONFIGS.map((name) => path30.join(top, name)).find((file) => existsSync13(file)) ?? null, isComment = (line) => /^\s*#/.test(line), COMMAND_SH, DIRECT_CALL, VAR_CALL, runsHelperText = (text) => {
+  const lines = text.split(/\r?\n/).filter((line) => !isComment(line));
+  const assigned = lines.some((line) => /(?:^|[\s;])h=/.test(line) && line.includes(HELPER_REF));
+  return lines.some((line) => DIRECT_CALL.test(line) || assigned && VAR_CALL.test(line));
+}, LEFTHOOK_YAML, indentOf = (line) => line.length - line.trimStart().length, lefthookRunsHelper = (text) => {
+  const lines = text.split(/\r?\n/);
+  const start = lines.findIndex((line) => /^prepare-commit-msg:\s*(?:#.*)?$/.test(line));
+  if (start < 0)
+    return false;
+  const block = [];
+  for (const line of lines.slice(start + 1)) {
+    if (line.trim() && !isComment(line) && indentOf(line) === 0)
+      break;
+    block.push(line);
+  }
+  return block.some((line, i) => {
+    if (isComment(line))
+      return false;
+    const runKey = /^(\s*)(?:-\s+)?run:\s*(.*)$/.exec(line);
+    if (!runKey)
+      return false;
+    let value = runKey[2] ?? "";
+    if (/^[|>][-+]?\s*$/.test(value)) {
+      const body = [];
+      for (const next of block.slice(i + 1)) {
+        if (next.trim() && indentOf(next) <= indentOf(line))
+          break;
+        body.push(next);
+      }
+      value = body.join(`
+`);
+    }
+    return runsHelperText(value);
+  });
+}, isExecutable = (file) => {
+  if (process.platform === "win32")
+    return true;
+  try {
+    return (statSync4(file).mode & 73) !== 0;
+  } catch {
+    return false;
+  }
+}, manualInPlace = (input, target) => {
+  if (input.owner === "lefthook")
+    return LEFTHOOK_YAML.some((name) => {
+      const text = readText(path30.join(input.top, name));
+      return text !== null && lefthookRunsHelper(text);
+    });
+  const text = readText(target);
+  if (text === null || !runsHelperText(text))
+    return false;
+  return input.owner === "husky" && target !== input.hookPath || isExecutable(target);
+}, isHuskyV9 = (text, hooksDir) => /\$\(dirname (?:-- )?"\$0"\)\/h"/.test(text) && existsSync13(path30.join(hooksDir, "h")), ownerOf = (text, hooksDir, top) => {
+  if (text.includes("husky.sh") || isHuskyV9(text, hooksDir))
+    return "husky";
+  if (/lefthook/i.test(text) || lefthookConfig(top))
+    return "lefthook";
+  return "other";
+}, manualTargetOf = ({ owner, text, hooksDir, hookPath, top }) => {
+  if (owner === "husky" && isHuskyV9(text, hooksDir))
+    return path30.join(path30.dirname(hooksDir), SESSION_HOOK_NAME);
+  if (owner === "lefthook")
+    return lefthookConfig(top) ?? path30.join(top, "lefthook.yml");
+  return hookPath;
+}, manualFor = (input) => {
+  const { owner, displaced } = input;
+  const target = manualTargetOf(input);
+  const stale = displaced ? `; delete the stale ${displaced} (nothing runs it)` : "";
+  if (owner === "husky")
+    return `add this line to ${target} (create it if missing; husky runs it)${stale}: ${manualTrailerLine()}`;
+  if (owner === "lefthook")
+    return [
+      `merge this job into ${target} (add it to an existing \`${SESSION_HOOK_NAME}:\` \`jobs:\` list rather than a second \`${SESSION_HOOK_NAME}:\` key), then run \`lefthook install\`${stale}:`,
+      `${SESSION_HOOK_NAME}:`,
+      "  jobs:",
+      "    - name: workit-session",
+      `      run: ${lefthookTrailerRun()}`
+    ].join(`
+`);
+  return `add this line to ${target} (a new file needs \`#!/bin/sh\` as its first line and \`chmod +x\`)${stale}: ${manualTrailerLine()}`;
+}, leftoverOf = (hooksDir) => {
+  const chained = path30.join(hooksDir, LEGACY_CHAINED);
+  const commitMsg = path30.join(hooksDir, "commit-msg");
+  const oldOurs = readText(commitMsg)?.includes(SESSION_HOOK_MARKER) ?? false;
+  if (exists(chained))
+    return oldOurs ? `${chained} was left by an earlier Workit build: move it back to ${commitMsg} (replacing Workit's old hook there)` : `${chained} was left by an earlier Workit build and nothing runs it: if it is your original commit-msg hook, move it back to ${commitMsg}; otherwise delete it`;
+  if (oldOurs)
+    return `${commitMsg} is a hook from an earlier Workit build; delete it (the trailer now comes from ${SESSION_HOOK_NAME})`;
+  return;
+}, writeExecutable = (file, content) => {
+  mkdirSync5(path30.dirname(file), { recursive: true });
+  const staged = `${file}.workit-new`;
+  try {
+    writeFileSync6(staged, content, { mode: 493 });
+    chmodSync(staged, 493);
+    renameSync3(staged, file);
+  } finally {
+    rmSync2(staged, { force: true });
+  }
+};
+var init_session_hook = __esm(() => {
+  init_rev();
+  HELPER = ["workit", "session-trailer.sh"];
+  HELPER_REF = HELPER.join("/");
+  SESSION_HOOK_SCRIPT = `#!/bin/sh
+${SESSION_HOOK_MARKER} v4
+# Workit (https://github.com/BrainerVirus/workit) installed this hook with
+# \`workit doctor --fix\`: it runs Workit's session-trailer helper, which adds a
+# Workit-Session trailer to commits made in an agent session. To remove it,
+# delete this file.
+${manualTrailerLine()}
+`;
+  LEFTHOOK_CONFIGS = [
+    "lefthook.yml",
+    "lefthook.yaml",
+    ".lefthook.yml",
+    ".lefthook.yaml",
+    "lefthook.json",
+    "lefthook.toml"
+  ];
+  COMMAND_SH = String.raw`(?:^|[;&|(!]|\b(?:then|do|else)\s)\s*sh\s+`;
+  DIRECT_CALL = new RegExp(String.raw`${COMMAND_SH}(?:"[^"]*|\S*)${HELPER_REF.replaceAll(".", String.raw`\.`)}`);
+  VAR_CALL = new RegExp(String.raw`${COMMAND_SH}"?\$h\b`);
+  LEFTHOOK_YAML = [
+    "lefthook.yml",
+    "lefthook.yaml",
+    ".lefthook.yml",
+    ".lefthook.yaml",
+    "lefthook-local.yml",
+    "lefthook-local.yaml",
+    ".lefthook-local.yml",
+    ".lefthook-local.yaml"
+  ];
+});
+
+// packages/workit-cli/src/admin/doctor.ts
+import { spawnSync as spawnSync14 } from "node:child_process";
+import { createHash as createHash13 } from "node:crypto";
+import {
+  existsSync as existsSync14,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync6,
+  mkdtempSync,
+  readdirSync as readdirSync7,
+  readFileSync as readFileSync14,
+  readlinkSync as readlinkSync2,
+  rmSync as rmSync3,
+  statSync as statSync5,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync7
+} from "node:fs";
+import os8 from "node:os";
+import path31 from "node:path";
 var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
-  let dir = path30.resolve(cwd);
+  let dir = path31.resolve(cwd);
   while (true) {
-    if (existsSync13(path30.join(dir, "packages", "workit-core", "package.json")))
+    if (existsSync14(path31.join(dir, "packages", "workit-core", "package.json")))
       return dir;
-    const parent = path30.dirname(dir);
+    const parent = path31.dirname(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -63969,8 +64292,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, resolve = (options) => {
   const env = options.env ?? process.env;
   const home = options.home ?? env.HOME ?? os8.homedir();
-  const configDir = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path30.join(home, ".config", "workit");
-  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path30.join(home, ".local", "state", "workit");
+  const configDir = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path31.join(home, ".config", "workit");
+  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path31.join(home, ".local", "state", "workit");
   const cwd = options.cwd ?? process.cwd();
   const dev = options.dev ?? env.WORKFLOW_TOOLKIT_DEV ?? findDevFromCwd(cwd);
   return {
@@ -63981,11 +64304,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     cwd,
     workspaceRoot: options.workspaceRoot ?? env.WORKFLOW_WORKSPACE_ROOT ?? cwd,
     dev,
-    opencodeConfig: options.opencodeConfig ?? path30.join(home, ".config", "opencode", "opencode.json"),
-    opencodePackageCacheDir: options.opencodePackageCacheDir ?? path30.join(home, ".cache", "opencode", "packages", "@brainervirus", "workit-opencode@latest"),
-    cursorSettings: options.cursorSettings ?? path30.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path30.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path30.join(home, ".cursor", "plugins", "local", "workit"),
+    opencodeConfig: options.opencodeConfig ?? path31.join(home, ".config", "opencode", "opencode.json"),
+    opencodePackageCacheDir: options.opencodePackageCacheDir ?? path31.join(home, ".cache", "opencode", "packages", "@brainervirus", "workit-opencode@latest"),
+    cursorSettings: options.cursorSettings ?? path31.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path31.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path31.join(home, ".cursor", "plugins", "local", "workit"),
     cursorHeartbeatDir: options.stateDir ?? (env.WORKFLOW_TOOLKIT_STATE || resolveStateDir()),
     codexHome: options.codexHome,
     piAgentDir: options.piAgentDir,
@@ -63995,14 +64318,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, readJson = (p) => {
   try {
-    const parsed = JSON.parse(readFileSync13(p, "utf8"));
+    const parsed = JSON.parse(readFileSync14(p, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }, parsesAsConfigObject = (p) => {
   try {
-    return isConfigObject(JSON.parse(readFileSync13(p, "utf8")));
+    return isConfigObject(JSON.parse(readFileSync14(p, "utf8")));
   } catch {
     return false;
   }
@@ -64012,14 +64335,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     ...new Set(entries.filter((entry) => typeof entry === "string" && isWorkitPlugin(entry)))
   ];
 }, commandOnPath = (name, env) => findOnPath(process.platform === "win32" ? [name, `${name}.exe`] : [name], env) !== null, pathextNames = (name, env) => process.platform === "win32" ? (env.PATHEXT ?? process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean).map((ext) => `${name}${ext.toLowerCase()}`) : [name], findOnPath = (names, env) => {
-  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path30.delimiter);
+  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path31.delimiter);
   for (const dir of dirs) {
     if (!dir)
       continue;
     for (const candidateName of names) {
-      const candidate = path30.join(dir, candidateName);
+      const candidate = path31.join(dir, candidateName);
       try {
-        const st = statSync4(candidate);
+        const st = statSync5(candidate);
         if (process.platform !== "win32" && (st.mode & 73) === 0)
           continue;
         return candidate;
@@ -64028,7 +64351,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return null;
 }, versionOf = (bin, env, timeout) => {
-  const r = spawnSync13(bin, ["--version"], { encoding: "utf8", env, timeout });
+  const r = spawnSync14(bin, ["--version"], { encoding: "utf8", env, timeout });
   if (r.error)
     return null;
   return (r.stdout ?? "").trim();
@@ -64043,14 +64366,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return true;
 }, resolveBun = (env) => {
-  if (env.BUN && existsSync13(env.BUN))
+  if (env.BUN && existsSync14(env.BUN))
     return env.BUN;
   for (const candidate of [
-    path30.join(os8.homedir(), ".bun/bin/bun"),
+    path31.join(os8.homedir(), ".bun/bin/bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ]) {
-    if (existsSync13(candidate))
+    if (existsSync14(candidate))
       return candidate;
   }
   return commandOnPath("bun", env) ? "bun" : null;
@@ -64098,7 +64421,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping version parity"
     };
   }
-  const corePkg = readJson(path30.join(res.dev, "packages/workit-core/package.json"));
+  const corePkg = readJson(path31.join(res.dev, "packages/workit-core/package.json"));
   if (!corePkg) {
     return {
       id: "versions",
@@ -64108,7 +64431,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   const refs = new Set;
   for (const name of ["workit-opencode", "workit-cursor", "workit-cli"]) {
-    const pkg = readJson(path30.join(res.dev, "packages", name, "package.json"));
+    const pkg = readJson(path31.join(res.dev, "packages", name, "package.json"));
     const dep = pkg?.dependencies?.["@brainervirus/workit-core"];
     if (typeof dep === "string")
       refs.add(dep);
@@ -64124,7 +64447,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (refs.size > 1) {
     problems.push(`adapters pin different core versions: ${[...refs].join(", ")}`);
   }
-  const opencodePkg = readJson(path30.join(res.dev, "packages/workit-opencode/package.json"));
+  const opencodePkg = readJson(path31.join(res.dev, "packages/workit-opencode/package.json"));
   const sdk = opencodePkg?.dependencies?.["@opencode/plugin"] ?? opencodePkg?.devDependencies?.["@opencode/plugin"];
   const sdkVersion = typeof sdk === "string" ? (sdk.match(/^\d+(?:\.\d+){0,2}/) ?? [])[0] : null;
   if (sdkVersion && !semverAtLeast(sdkVersion, SUPPORT_MATRIX.opencode.minimum)) {
@@ -64151,17 +64474,17 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "opencode CLI not on PATH — skipping version check"
     };
-  const scratch = mkdtempSync(path30.join(os8.tmpdir(), "workit-doctor-opencode-"));
+  const scratch = mkdtempSync(path31.join(os8.tmpdir(), "workit-doctor-opencode-"));
   let raw;
   try {
     raw = versionOf("opencode", {
       ...res.env,
-      XDG_DATA_HOME: path30.join(scratch, "data"),
-      XDG_STATE_HOME: path30.join(scratch, "state"),
-      XDG_CACHE_HOME: path30.join(scratch, "cache")
+      XDG_DATA_HOME: path31.join(scratch, "data"),
+      XDG_STATE_HOME: path31.join(scratch, "state"),
+      XDG_CACHE_HOME: path31.join(scratch, "cache")
     }, 5000);
   } finally {
-    rmSync2(scratch, { recursive: true, force: true });
+    rmSync3(scratch, { recursive: true, force: true });
   }
   const installed = raw ? (raw.match(/\d+\.\d+\.\d+/) ?? [])[0] ?? null : null;
   if (installed === null)
@@ -64216,7 +64539,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const tables = new Map;
   let text;
   try {
-    text = readFileSync13(file, "utf8");
+    text = readFileSync14(file, "utf8");
   } catch {
     return tables;
   }
@@ -64254,19 +64577,19 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     current[unquote(pair[1])] = value === "true" ? true : value === "false" ? false : unquote(value);
   }
   return tables;
-}, codexHomeOf = (res) => res.codexHome ?? (res.env.CODEX_HOME || path30.join(res.home, ".codex")), codexWorkitInstalls = (res) => {
+}, codexHomeOf = (res) => res.codexHome ?? (res.env.CODEX_HOME || path31.join(res.home, ".codex")), codexWorkitInstalls = (res) => {
   const codexHome = codexHomeOf(res);
-  const configFile = path30.join(codexHome, "config.toml");
+  const configFile = path31.join(codexHome, "config.toml");
   const installs = [];
   for (const [key, table] of readTomlTables(configFile)) {
     const [kind, id, ...rest] = key.split("\x00");
     if (kind !== "plugins" || rest.length > 0 || !id?.startsWith("workit@") || table.enabled === false)
       continue;
     const marketplace = id.slice("workit@".length);
-    const dir = path30.join(codexHome, "plugins", "cache", marketplace, "workit");
+    const dir = path31.join(codexHome, "plugins", "cache", marketplace, "workit");
     let versions = [];
     try {
-      versions = readdirSync7(dir).filter((v) => existsSync13(path30.join(dir, v, ".codex-plugin")));
+      versions = readdirSync7(dir).filter((v) => existsSync14(path31.join(dir, v, ".codex-plugin")));
     } catch {
       versions = [];
     }
@@ -64274,7 +64597,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     installs.push({
       id,
       marketplace,
-      root: version ? path30.join(dir, version) : null,
+      root: version ? path31.join(dir, version) : null,
       version,
       configFile
     });
@@ -64296,7 +64619,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
   return `sha256:${createHash13("sha256").update(JSON.stringify(body)).digest("hex")}`;
 }, codexHookTrust = (install, tables) => {
-  const hooks = install.root ? readJson(path30.join(install.root, "hooks", "hooks.json"))?.hooks : null;
+  const hooks = install.root ? readJson(path31.join(install.root, "hooks", "hooks.json"))?.hooks : null;
   if (!hooks || typeof hooks !== "object")
     return null;
   const result = [];
@@ -64369,28 +64692,28 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "no Workit Codex plugin enabled — skipping"
     };
-  const agentsDir = path30.join(codexHomeOf(res), "agents");
+  const agentsDir = path31.join(codexHomeOf(res), "agents");
   const problems = [];
   const fixes = [];
   const installed = [];
   for (const install of installs) {
-    const source = install.root ? path30.join(install.root, "agents") : null;
-    const files = source && existsSync13(source) ? readdirSync7(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
+    const source = install.root ? path31.join(install.root, "agents") : null;
+    const files = source && existsSync14(source) ? readdirSync7(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
     if (files.length === 0) {
       problems.push(`${install.id} ${install.version ?? "?"} bundles no agents`);
       fixes.push(`codex plugin remove ${install.id} && codex plugin add ${install.id}`);
       continue;
     }
-    const install_fix = `node ${JSON.stringify(path30.join(install.root, "dist", "launch-mcp.js"))} --install-agents, then start a new Codex session`;
-    const pluginVersion = readJson(path30.join(install.root, "package.json"))?.version;
+    const install_fix = `node ${JSON.stringify(path31.join(install.root, "dist", "launch-mcp.js"))} --install-agents, then start a new Codex session`;
+    const pluginVersion = readJson(path31.join(install.root, "package.json"))?.version;
     const version = typeof pluginVersion === "string" ? pluginVersion.match(SEMVER)?.[0] ?? null : null;
     let stale = false;
     for (const file of files) {
-      const dest = path30.join(agentsDir, file);
-      const want = stampCodexAgent(readFileSync13(path30.join(source, file), "utf8"), version);
+      const dest = path31.join(agentsDir, file);
+      const want = stampCodexAgent(readFileSync14(path31.join(source, file), "utf8"), version);
       let link = false;
       try {
-        link = lstatSync4(dest).isSymbolicLink();
+        link = lstatSync5(dest).isSymbolicLink();
       } catch {
         link = false;
       }
@@ -64401,7 +64724,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       }
       let have = null;
       try {
-        have = readFileSync13(dest, "utf8");
+        have = readFileSync14(dest, "utf8");
       } catch {
         have = null;
       }
@@ -64440,7 +64763,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const env = res.env.PI_CODING_AGENT_DIR;
   if (env)
     return env === "~" ? res.home : env.replace(/^~(?=\/|\\)/, res.home);
-  return path30.join(res.home, ".pi", "agent");
+  return path31.join(res.home, ".pi", "agent");
 }, npmSpecName = (spec) => {
   const at = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
   return at > 0 ? { name: spec.slice(0, at), pinned: true } : { name: spec, pinned: false };
@@ -64448,10 +64771,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const scopes = [
     {
       scope: "project",
-      settingsFile: path30.join(res.cwd, ".pi", "settings.json"),
-      base: path30.join(res.cwd, ".pi")
+      settingsFile: path31.join(res.cwd, ".pi", "settings.json"),
+      base: path31.join(res.cwd, ".pi")
     },
-    { scope: "user", settingsFile: path30.join(agentDir, "settings.json"), base: agentDir }
+    { scope: "user", settingsFile: path31.join(agentDir, "settings.json"), base: agentDir }
   ];
   for (const { scope, settingsFile, base } of scopes) {
     const packages = readJson(settingsFile)?.packages;
@@ -64466,13 +64789,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
         const spec = npmSpecName(source.slice(4).trim());
         if (spec.name !== PI_PACKAGE)
           continue;
-        const root = path30.join(base, "npm", "node_modules", ...PI_PACKAGE.split("/"));
+        const root = path31.join(base, "npm", "node_modules", ...PI_PACKAGE.split("/"));
         return { scope, settingsFile, source, filter, root, npm: { pinned: spec.pinned } };
       }
       if (/^(git:|https?:|ssh:|git@)/.test(source))
         continue;
-      const local = path30.resolve(base, source.replace(/^~(?=\/|\\)/, res.home));
-      if (readJson(path30.join(local, "package.json"))?.name === PI_PACKAGE)
+      const local = path31.resolve(base, source.replace(/^~(?=\/|\\)/, res.home));
+      if (readJson(path31.join(local, "package.json"))?.name === PI_PACKAGE)
         return { scope, settingsFile, source, filter, root: local, npm: null };
     }
   }
@@ -64483,7 +64806,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const list = patterns.filter((p) => typeof p === "string");
   if (list.length === 0)
     return false;
-  const name = path30.posix.basename(file);
+  const name = path31.posix.basename(file);
   const matches = (p) => {
     const re = globToRegExp3(p);
     return re.test(file) || re.test(name);
@@ -64500,7 +64823,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return kept;
 }, checkPiExtension = (res) => {
   const agentDir = piAgentDirOf(res);
-  if (!existsSync13(agentDir) && !commandOnPath("pi", res.env))
+  if (!existsSync14(agentDir) && !commandOnPath("pi", res.env))
     return { id: "pi_extension", status: "pass", detail: "Pi not installed — skipping" };
   const installCmd = (scope, spec = `npm:${PI_PACKAGE}`) => `pi install ${spec}${scope === "project" ? " -l" : ""}`;
   const entry = findPiEntry(res, agentDir);
@@ -64508,12 +64831,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return {
       id: "pi_extension",
       status: "warn",
-      detail: `Workit Pi extension missing: no ${PI_PACKAGE} entry in ${path30.join(agentDir, "settings.json")} or ${path30.join(res.cwd, ".pi", "settings.json")}`,
+      detail: `Workit Pi extension missing: no ${PI_PACKAGE} entry in ${path31.join(agentDir, "settings.json")} or ${path31.join(res.cwd, ".pi", "settings.json")}`,
       fix: installCmd("user")
     };
   const where = `${entry.source} (${entry.scope}, ${entry.settingsFile})`;
   const rebuild = `cd ${JSON.stringify(entry.root)} && bun run build`;
-  const pkg = readJson(path30.join(entry.root, "package.json"));
+  const pkg = readJson(path31.join(entry.root, "package.json"));
   if (!pkg)
     return {
       id: "pi_extension",
@@ -64522,7 +64845,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: entry.npm ? installCmd(entry.scope, entry.source) : `restore ${entry.root}, then ${rebuild}`
     };
   const declared = Array.isArray(pkg.pi?.extensions) ? pkg.pi.extensions.some((e) => typeof e === "string" && e.replace(/^\.\//, "") === PI_EXTENSION) : false;
-  if (!declared || !existsSync13(path30.join(entry.root, PI_EXTENSION)))
+  if (!declared || !existsSync14(path31.join(entry.root, PI_EXTENSION)))
     return {
       id: "pi_extension",
       status: "warn",
@@ -64575,25 +64898,25 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     detail: `Workit Pi extension ${version ?? "?"} from ${where} loads ${PI_EXTENSION}`
   };
 }, assetPathsFor = (host, dev) => {
-  const pkg = path30.join(dev, "packages", `workit-${host}`);
+  const pkg = path31.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode": {
-      const packaged = path30.join(pkg, "assets", "skills");
-      const root = existsSync13(packaged) ? packaged : path30.join(dev, "packages", "workit-core", "skills");
-      return WORKIT_METHOD_SKILLS.map((skill) => path30.join(root, skill, "SKILL.md"));
+      const packaged = path31.join(pkg, "assets", "skills");
+      const root = existsSync14(packaged) ? packaged : path31.join(dev, "packages", "workit-core", "skills");
+      return WORKIT_METHOD_SKILLS.map((skill) => path31.join(root, skill, "SKILL.md"));
     }
     case "cursor":
       return [
-        path30.join(pkg, "assets", "templates", "workit-contract.md"),
-        path30.join(pkg, "mcp.json"),
-        path30.join(pkg, ".cursor-plugin")
+        path31.join(pkg, "assets", "templates", "workit-contract.md"),
+        path31.join(pkg, "mcp.json"),
+        path31.join(pkg, ".cursor-plugin")
       ];
     case "cli":
-      return [path30.join(pkg, "assets", "templates", "spec-template.md")];
+      return [path31.join(pkg, "assets", "templates", "spec-template.md")];
   }
 }, hostsFor = (host) => host === "cli" ? ["opencode", "cursor", "cli"] : [host], checkAssets = (res) => {
   const dev = res.dev;
-  const missing = dev ? hostsFor(res.host).flatMap((h) => assetPathsFor(h, dev).filter((p) => !existsSync13(p)).map((p) => `${h}: ${p}`)) : [];
+  const missing = dev ? hostsFor(res.host).flatMap((h) => assetPathsFor(h, dev).filter((p) => !existsSync14(p)).map((p) => `${h}: ${p}`)) : [];
   if (res.host === "cursor" || res.host === "cli") {
     const cursorError = validateCursorSkills(res.cursorPluginDir, WORKIT_METHOD_SKILLS);
     if (cursorError)
@@ -64620,31 +64943,31 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: "Reinstall or rebuild the workit package (missing assets under packages/workit-<host>)"
   };
 }, launcherSlotsFor = (host, dev) => {
-  const pkg = path30.join(dev, "packages", `workit-${host}`);
+  const pkg = path31.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode":
-      return [[path30.join(pkg, "src", "plugin.ts"), path30.join(pkg, "dist", "plugin.js")]];
+      return [[path31.join(pkg, "src", "plugin.ts"), path31.join(pkg, "dist", "plugin.js")]];
     case "cursor":
       return [
-        [path30.join(pkg, "dist", "mcp-server.js")],
-        [path30.join(pkg, "dist", "cursor-session-start.js")]
+        [path31.join(pkg, "dist", "mcp-server.js")],
+        [path31.join(pkg, "dist", "cursor-session-start.js")]
       ];
     case "cli":
-      return [[path30.join(pkg, "src", "index.tsx"), path30.join(pkg, "dist", "index.js")]];
+      return [[path31.join(pkg, "src", "index.tsx"), path31.join(pkg, "dist", "index.js")]];
   }
 }, validNodeEntry = (entry, runtime, env) => {
   try {
-    const stat = statSync4(entry);
-    if (!stat.isFile() || stat.size === 0 || !readFileSync13(entry, "utf8").startsWith(`#!/usr/bin/env node
+    const stat = statSync5(entry);
+    if (!stat.isFile() || stat.size === 0 || !readFileSync14(entry, "utf8").startsWith(`#!/usr/bin/env node
 `)) {
       return false;
     }
-    return spawnSync13(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
+    return spawnSync14(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
   } catch {
     return false;
   }
 }, registeredCursorLauncher = (res) => {
-  if (!existsSync13(res.cursorMcp))
+  if (!existsSync14(res.cursorMcp))
     return "invalid";
   const config = readJson(res.cursorMcp);
   if (!config)
@@ -64657,7 +64980,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (typeof command !== "string" || !Array.isArray(args) || typeof args[0] !== "string") {
     return "invalid";
   }
-  const executable = path30.basename(command).toLowerCase();
+  const executable = path31.basename(command).toLowerCase();
   const canonical = cursorMcpServerEntry("").args;
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
     if (args.length !== canonical.length || args.some((a, i) => a !== canonical[i]))
@@ -64669,11 +64992,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return {
     kind: "node",
     runtime: command,
-    entry: path30.isAbsolute(args[0]) ? args[0] : path30.resolve(path30.dirname(res.cursorMcp), args[0])
+    entry: path31.isAbsolute(args[0]) ? args[0] : path31.resolve(path31.dirname(res.cursorMcp), args[0])
   };
 }, canonicalCursorHook, isCanonicalCursorHook = (command, res) => command === canonicalCursorHook || command === cursorHooksEntry(res.cursorPluginDir).command, registeredCursorHook = (res) => {
-  const hooksFile = path30.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
-  if (!existsSync13(hooksFile))
+  const hooksFile = path31.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  if (!existsSync14(hooksFile))
     return "invalid";
   const config = readJson(hooksFile);
   if (!config)
@@ -64690,9 +65013,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!m)
     return false;
   const entry = m[1].trim();
-  if (!path30.isAbsolute(entry))
+  if (!path31.isAbsolute(entry))
     return false;
-  if (path30.resolve(entry) !== path30.resolve(path30.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
+  if (path31.resolve(entry) !== path31.resolve(path31.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
     return false;
   }
   return validNodeEntry(entry, "node", res.env);
@@ -64701,7 +65024,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const hosts = hostsFor(res.host);
   const registered = hosts.includes("cursor") ? registeredCursorLauncher(res) : null;
   const runtime = registered && registered !== "invalid" && registered.kind === "node" ? registered.runtime : "node";
-  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path30.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
+  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path31.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
   if (hosts.includes("cursor")) {
     if (registered === "invalid") {
       missing.push(`cursor: canonical workit MCP launcher in ${res.cursorMcp}`);
@@ -64710,13 +65033,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     }
     const hook = registeredCursorHook(res);
     if (hook === "invalid") {
-      missing.push(`cursor: canonical session-start hook in ${path30.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
+      missing.push(`cursor: canonical session-start hook in ${path31.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
     } else if (hook !== null && !isCanonicalCursorHook(hook, res) && !validLocalDistHook(hook, res)) {
-      missing.push(`cursor: canonical session-start hook in ${path30.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
+      missing.push(`cursor: canonical session-start hook in ${path31.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
     }
   }
   if (dev) {
-    missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync13(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
+    missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync14(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
   }
   if (missing.length > 0) {
     return {
@@ -64741,21 +65064,21 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, CURSOR_HOOK_FIX = "Run `workit init` and select Cursor to install the bundled hook", checkCursorHook = (res) => {
   if (!hostsFor(res.host).includes("cursor"))
     return { id: "cursor_hook", status: "pass", detail: "cursor hook not inspected on this host" };
-  if (!existsSync13(res.cursorPluginDir))
+  if (!existsSync14(res.cursorPluginDir))
     return {
       id: "cursor_hook",
       status: "pass",
       detail: "no Cursor plugin install — hook launcher not inspected"
     };
-  const launcher = path30.join(res.cursorPluginDir, "hooks", "launch.mjs");
-  if (!existsSync13(launcher))
+  const launcher = path31.join(res.cursorPluginDir, "hooks", "launch.mjs");
+  if (!existsSync14(launcher))
     return {
       id: "cursor_hook",
       status: "warn",
       detail: `cursor hook launcher mode: missing — ${launcher} is absent (an install from before the pinned launcher)`,
       fix: CURSOR_HOOK_FIX
     };
-  const hooksFile = path30.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hooksFile = path31.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
   const registered = readJson(hooksFile);
   const sessionCommand = registered?.hooks?.sessionStart?.[0]?.command;
   const offLauncher = [
@@ -64770,7 +65093,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Re-run install-cursor-plugin.sh (or `workit init` with Cursor) to rewrite the hook entries"
     };
   const started = performance.now();
-  const probe = spawnSync13("node", [launcher, "--probe", "workit-cursor-hook"], {
+  const probe = spawnSync14("node", [launcher, "--probe", "workit-cursor-hook"], {
     encoding: "utf8",
     env: { ...res.env, WORKIT_CURSOR_HOOK_NPX_OFFLINE: "1" },
     timeout: 40000,
@@ -64817,15 +65140,15 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return { id: "cursor_hook", status: "pass", detail: `${label}; probe ${ms} ms` };
 }, SILENT_HOOK_GRACE_MS, mtimeMs = (file) => {
   try {
-    return statSync4(file).mtimeMs;
+    return statSync5(file).mtimeMs;
   } catch {
     return null;
   }
 }, silentCursorHooks = (res) => {
-  const session = mtimeMs(path30.join(res.cursorHeartbeatDir, "cursor-session-last-start"));
+  const session = mtimeMs(path31.join(res.cursorHeartbeatDir, "cursor-session-last-start"));
   if (session === null || Date.now() - session < SILENT_HOOK_GRACE_MS)
     return null;
-  const hook = mtimeMs(path30.join(res.cursorHeartbeatDir, "cursor-hook-last-run"));
+  const hook = mtimeMs(path31.join(res.cursorHeartbeatDir, "cursor-hook-last-run"));
   if (hook !== null && hook >= session)
     return null;
   return `Cursor started the Workit MCP server at ${new Date(session).toISOString()} but no Workit hook has run since${hook === null ? " (none ever)" : ""} — if the agent ran in that window, Cursor is not running the plugin hooks and Workit enforcement is off`;
@@ -64866,7 +65189,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return "fragile-cache";
   if (entry.startsWith("file:")) {
     const target = entry.replace(/^file:\/\//, "").replace(/^file:/, "");
-    return existsSync13(target) ? "ok" : "missing-file";
+    return existsSync14(target) ? "ok" : "missing-file";
   }
   return "ok";
 }, checkStalePin = (res) => {
@@ -64877,7 +65200,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "opencode pin not inspected on the cursor host"
     };
   }
-  if (!existsSync13(res.opencodeConfig)) {
+  if (!existsSync14(res.opencodeConfig)) {
     return {
       id: "stale_pin",
       status: "pass",
@@ -64921,8 +65244,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return { id: "stale_pin", status: "pass", detail: "opencode pin resolves" };
 }, pluginMcpSelectors = (res) => {
-  const p = path30.join(res.cursorPluginDir, "mcp.json");
-  if (!existsSync13(p))
+  const p = path31.join(res.cursorPluginDir, "mcp.json");
+  if (!existsSync14(p))
     return null;
   const cfg = readJson(p);
   const server = cfg?.mcpServers?.workit;
@@ -64944,7 +65267,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!cmd)
     return null;
   try {
-    const r = spawnSync13(cmd, ["view", pkgName, "version"], {
+    const r = spawnSync14(cmd, ["view", pkgName, "version"], {
       encoding: "utf8",
       timeout: 20000,
       env: res.env
@@ -64955,13 +65278,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return null;
   }
 }, installedPluginVersion = (res) => {
-  const pkg = readJson(path30.join(res.cursorPluginDir, "package.json"));
+  const pkg = readJson(path31.join(res.cursorPluginDir, "package.json"));
   return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
 }, installedOpenCodeCacheVersion = (res) => {
-  const pkg = readJson(path30.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
+  const pkg = readJson(path31.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
   return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
 }, checkOpenCodePackageCache = (res) => {
-  if (!existsSync13(res.opencodeConfig)) {
+  if (!existsSync14(res.opencodeConfig)) {
     return {
       id: "stale_install",
       status: "pass",
@@ -65035,7 +65358,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "cursor plugin not inspected on this host"
     };
   }
-  if (existsSync13(res.cursorPluginDir) && lstatSync4(res.cursorPluginDir).isSymbolicLink()) {
+  if (existsSync14(res.cursorPluginDir) && lstatSync5(res.cursorPluginDir).isSymbolicLink()) {
     let target = "";
     try {
       target = readlinkSync2(res.cursorPluginDir);
@@ -65061,7 +65384,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Re-run install-cursor-plugin.sh — it rewrites the workit MCP entry to the canonical @latest selector"
     };
   }
-  const hooksFile = path30.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hooksFile = path31.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
   const hookCmd = readJson(hooksFile)?.hooks?.sessionStart?.[0]?.command ?? null;
   const canonicalHook = canonicalCursorHook;
   const staleHook = hookCmd !== null && !isCanonicalCursorHook(hookCmd, res) && !hookCmd.startsWith("node ") && hookCmd.includes("@brainervirus/workit-cursor@");
@@ -65073,7 +65396,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Re-run install-cursor-plugin.sh — it rewrites the sessionStart hook to the canonical pinned launcher"
     };
   }
-  const hookDrift = existsSync13(hooksFile) ? cursorHookDrift(readJson(hooksFile), res.cursorPluginDir) : [];
+  const hookDrift = existsSync14(hooksFile) ? cursorHookDrift(readJson(hooksFile), res.cursorPluginDir) : [];
   if (hookDrift.length > 0) {
     return {
       id: "stale_install",
@@ -65083,7 +65406,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     };
   }
   const installed = installedPluginVersion(res);
-  const source = res.dev ? readJson(path30.join(res.dev, "packages/workit-cursor/package.json"))?.version ?? null : readJson(path30.join(packageRoot(), "package.json"))?.version ?? null;
+  const source = res.dev ? readJson(path31.join(res.dev, "packages/workit-cursor/package.json"))?.version ?? null : readJson(path31.join(packageRoot(), "package.json"))?.version ?? null;
   const localDist = mcpSelectors === null && hookCmd !== null && !isCanonicalCursorHook(hookCmd, res) && hookCmd.startsWith("node ");
   if (localDist && installed !== null && source !== null && !semverAtLeast(installed, source)) {
     return {
@@ -65095,7 +65418,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   if (localDist && installed !== null && source !== null && res.dev) {
     const entry = /^node\s+(.+)$/.exec((hookCmd ?? "").trim())?.[1]?.trim() ?? "";
-    const sourceBundle = entry && path30.isAbsolute(entry) ? path30.join(res.dev, "packages", "workit-cursor", "dist", path30.basename(entry)) : "";
+    const sourceBundle = entry && path31.isAbsolute(entry) ? path31.join(res.dev, "packages", "workit-cursor", "dist", path31.basename(entry)) : "";
     if (entry && sourceBundle) {
       const installedHash = bundleHashOfFile(entry);
       const sourceHash = bundleHashOfFile(sourceBundle);
@@ -65103,7 +65426,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
         return {
           id: "stale_install",
           status: "fail",
-          detail: `stale_install: installed workit-cursor ${installed} runs different bytes than the current runtime build (${path30.basename(entry)} hash mismatch)`,
+          detail: `stale_install: installed workit-cursor ${installed} runs different bytes than the current runtime build (${path31.basename(entry)} hash mismatch)`,
           fix: "Re-run install-cursor-plugin.sh — it refreshes the plugin directory with the current build"
         };
       }
@@ -65157,13 +65480,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const problems = [];
   const opencodeHost = res.host !== "cursor";
   const cursorHost = res.host !== "opencode";
-  if (opencodeHost && existsSync13(res.opencodeConfig)) {
+  if (opencodeHost && existsSync14(res.opencodeConfig)) {
     const cfg = readJson(res.opencodeConfig);
     const entries = pluginEntries(cfg);
     if (entries.length > 1)
       problems.push(`opencode registers ${entries.length} workit plugin entries`);
   }
-  if (cursorHost && existsSync13(res.cursorSettings)) {
+  if (cursorHost && existsSync14(res.cursorSettings)) {
     const settings = readJson(res.cursorSettings);
     const enabled = settings?.enabled_plugins;
     if (enabled && typeof enabled === "object") {
@@ -65178,7 +65501,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     if (dirs.length > 1)
       problems.push(`cursor plugin_dirs has ${dirs.length} workit entries`);
   }
-  if (cursorHost && existsSync13(res.cursorMcp)) {
+  if (cursorHost && existsSync14(res.cursorMcp)) {
     const mcp = readJson(res.cursorMcp);
     const servers = mcp?.mcpServers ?? {};
     if (servers && typeof servers === "object") {
@@ -65203,17 +65526,17 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, checkMalformedConfig = (res) => {
   const files = [];
   for (const name of ["config.json", "youtrack.json", "vcs.json", "workspaces.json"]) {
-    const p = path30.join(res.configDir, name);
-    if (existsSync13(p))
+    const p = path31.join(res.configDir, name);
+    if (existsSync14(p))
       files.push(p);
   }
   const opencodeHost = res.host !== "cursor";
   const cursorHost = res.host !== "opencode";
-  if (opencodeHost && existsSync13(res.opencodeConfig))
+  if (opencodeHost && existsSync14(res.opencodeConfig))
     files.push(res.opencodeConfig);
-  if (cursorHost && existsSync13(res.cursorSettings))
+  if (cursorHost && existsSync14(res.cursorSettings))
     files.push(res.cursorSettings);
-  if (cursorHost && existsSync13(res.cursorMcp))
+  if (cursorHost && existsSync14(res.cursorMcp))
     files.push(res.cursorMcp);
   const bad = files.filter((p) => !parsesAsConfigObject(p));
   if (bad.length === 0)
@@ -65292,19 +65615,90 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     detail: `current directory ${res.cwd} does not match any configured workspace`,
     fix: `Add a workspace glob matching this directory to ${file} or run /wk-init`
   };
+}, matchedWorkspace = (res) => {
+  try {
+    return resolveWorkspaceFrom(res.cwd, res.configDir, res.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
+  } catch {
+    return null;
+  }
+}, SESSION_HOOK_FIX = "workit doctor --fix", sessionHookFinding = (hook) => {
+  const slot = `${SESSION_HOOK_NAME} hook`;
+  switch (hook.state) {
+    case "not_git":
+      return { status: "pass", detail: `not inside a git work tree — skipping the ${slot}` };
+    case "installed":
+      return {
+        status: "pass",
+        detail: `${slot} ${hook.hookPath} adds the Workit-Session trailer to plain git commits`
+      };
+    case "manual":
+      return hook.helperCurrent ? {
+        status: "pass",
+        detail: `${hook.manualTarget} adds the Workit-Session trailer to plain git commits (via ${hook.via})`
+      } : {
+        status: "warn",
+        detail: `${hook.manualTarget} runs the Workit helper (via ${hook.via}), but ${hook.helperPath} is missing or an older version`,
+        fix: SESSION_HOOK_FIX
+      };
+    case "missing":
+      return {
+        status: "warn",
+        detail: `no ${slot} at ${hook.hookPath}: plain git commits from an agent session get no Workit-Session trailer`,
+        fix: SESSION_HOOK_FIX
+      };
+    case "outdated":
+      return {
+        status: "warn",
+        detail: `the Workit ${slot} at ${hook.hookPath} or its helper ${hook.helperPath} is missing or an older version`,
+        fix: SESSION_HOOK_FIX
+      };
+    case "blocked":
+      return {
+        status: "warn",
+        detail: `plain git commits get no Workit-Session trailer and --fix will not install the ${slot}: ${hook.reason}`,
+        fix: hook.helperCurrent ? hook.manual : `${SESSION_HOOK_FIX} (writes ${hook.helperPath}), then ${hook.manual}`
+      };
+  }
+}, checkSessionHook = (res) => {
+  if (!matchedWorkspace(res))
+    return {
+      id: "session_hook",
+      status: "pass",
+      detail: `not in a Workit workspace — skipping the ${SESSION_HOOK_NAME} session hook`
+    };
+  const hook = inspectSessionHook(res.cwd, res.env);
+  const finding = sessionHookFinding(hook);
+  if (!hook.leftover)
+    return { id: "session_hook", ...finding };
+  return {
+    id: "session_hook",
+    status: "warn",
+    detail: `${finding.detail}; ${hook.leftover}`,
+    fix: finding.fix ? `${finding.fix}; ${hook.leftover}` : hook.leftover
+  };
+}, fixSessionHook = (options = {}) => {
+  const res = resolve(options);
+  const workspace = matchedWorkspace(res);
+  if (!workspace)
+    return {
+      action: "skipped",
+      detail: `${res.cwd} is not in a Workit workspace; no hook installed`,
+      workspace: null
+    };
+  return { ...installSessionHook(res.cwd, res.env), workspace: workspace.name };
 }, isPlaceholder = (p) => {
   try {
-    return readFileSync13(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
+    return readFileSync14(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
   } catch {
     return false;
   }
 }, checkCredentialMetadata = (res) => {
   const tokenPaths = [];
-  const youtrackJson = readJson(path30.join(res.configDir, "youtrack.json"));
+  const youtrackJson = readJson(path31.join(res.configDir, "youtrack.json"));
   if (youtrackJson) {
-    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path30.join(res.configDir, "youtrack.token"));
-  } else if (existsSync13(path30.join(res.configDir, "youtrack.token"))) {
-    tokenPaths.push(path30.join(res.configDir, "youtrack.token"));
+    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path31.join(res.configDir, "youtrack.token"));
+  } else if (existsSync14(path31.join(res.configDir, "youtrack.token"))) {
+    tokenPaths.push(path31.join(res.configDir, "youtrack.token"));
   }
   if (tokenPaths.length === 0) {
     return {
@@ -65315,13 +65709,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   const problems = [];
   for (const raw of tokenPaths) {
-    const p = path30.isAbsolute(raw) ? raw : path30.resolve(res.configDir, raw);
-    if (!existsSync13(p)) {
+    const p = path31.isAbsolute(raw) ? raw : path31.resolve(res.configDir, raw);
+    if (!existsSync14(p)) {
       problems.push(`${p} is missing`);
       continue;
     }
     if (process.platform !== "win32") {
-      const mode = statSync4(p).mode & 511;
+      const mode = statSync5(p).mode & 511;
       if (mode !== 384)
         problems.push(`${p} must be mode 0600 (found ${mode.toString(8)})`);
     }
@@ -65383,7 +65777,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, defaultIdentityProbes = (env) => ({
   origin: (cwd) => {
     try {
-      const out = spawnSync13("git", ["remote", "get-url", "origin"], {
+      const out = spawnSync14("git", ["remote", "get-url", "origin"], {
         cwd,
         encoding: "utf8",
         env
@@ -65395,7 +65789,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   ghLogin: (e) => {
     try {
-      const out = spawnSync13("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
+      const out = spawnSync14("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
       const login = (out.stdout ?? "").trim();
       return out.status === 0 && login ? login : null;
     } catch {
@@ -65404,7 +65798,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   glabLogin: (e) => {
     try {
-      const out = spawnSync13("glab", ["api", "user", "--jq", ".username"], {
+      const out = spawnSync14("glab", ["api", "user", "--jq", ".username"], {
         encoding: "utf8",
         env: e
       });
@@ -65416,7 +65810,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   sshLogin: (host) => {
     try {
-      const out = spawnSync13("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
+      const out = spawnSync14("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
         encoding: "utf8",
         env
       });
@@ -65431,7 +65825,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const remoteHost = githubHostFromRemote(probes.origin(res.cwd) ?? "");
   if (!remoteHost)
     return { id: "github_identity", status: "pass", detail: "no GitHub remote configured" };
-  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path30.join(res.configDir, "vcs.json"));
+  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path31.join(res.configDir, "vcs.json"));
   const workspace = workspaceProviderForIdentity(res.cwd, res.configDir, res.env);
   if (workspace.error)
     return {
@@ -65459,7 +65853,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const remoteHost = githubHostFromRemote(probes.origin(res.cwd) ?? "");
   if (!remoteHost)
     return { id: "gitlab_identity", status: "pass", detail: "no GitLab remote configured" };
-  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path30.join(res.configDir, "vcs.json"));
+  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path31.join(res.configDir, "vcs.json"));
   const workspace = workspaceProviderForIdentity(res.cwd, res.configDir, res.env);
   if (workspace.error)
     return {
@@ -65485,11 +65879,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     { surface: "SSH", login: probes.sshLogin(remoteHost) }
   ]);
 }, checkLogWritable = (res) => {
-  const logsDir = path30.join(res.stateDir, "logs");
-  const probe = path30.join(logsDir, "doctor-probe.tmp");
+  const logsDir = path31.join(res.stateDir, "logs");
+  const probe = path31.join(logsDir, "doctor-probe.tmp");
   try {
-    mkdirSync5(logsDir, { recursive: true, mode: 448 });
-    writeFileSync6(probe, `{"probe":true}
+    mkdirSync6(logsDir, { recursive: true, mode: 448 });
+    writeFileSync7(probe, `{"probe":true}
 `, { mode: 384 });
     return {
       id: "log_writable",
@@ -65576,7 +65970,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, CLI_PACKAGE = "@brainervirus/workit-cli", SEMVER, WORKIT_PROBE_TIMEOUT_MS = 1e4, workitVersions, workitVersionAt = (bin, env) => {
   let key;
   try {
-    const st = statSync4(bin);
+    const st = statSync5(bin);
     key = `${bin}:${st.ino}:${st.size}:${st.mtimeMs}`;
   } catch {
     return { version: null, timedOut: false };
@@ -65585,12 +65979,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (cached)
     return cached;
   const viaShell = process.platform === "win32" && /\.(?:cmd|bat)$/i.test(bin);
-  const r = viaShell ? spawnSync13(`"${bin}" --version`, {
+  const r = viaShell ? spawnSync14(`"${bin}" --version`, {
     encoding: "utf8",
     env,
     timeout: WORKIT_PROBE_TIMEOUT_MS,
     shell: true
-  }) : spawnSync13(bin, ["--version"], { encoding: "utf8", env, timeout: WORKIT_PROBE_TIMEOUT_MS });
+  }) : spawnSync14(bin, ["--version"], { encoding: "utf8", env, timeout: WORKIT_PROBE_TIMEOUT_MS });
   const timedOut = r.error !== undefined && "code" in r.error && r.error.code === "ETIMEDOUT";
   const version = r.status === 0 ? (r.stdout ?? "").match(SEMVER)?.[0] ?? null : null;
   const probe = { version: timedOut ? null : version, timedOut };
@@ -65680,6 +66074,7 @@ var init_doctor = __esm(() => {
   init_workspaces();
   init_host_install();
   init_skill_manifests();
+  init_session_hook();
   OPENCODE_V1_FIX = `OpenCode < ${SUPPORT_MATRIX.opencode.minimum} cannot load Workit 3 (V2 plugin API only): upgrade OpenCode to ${SUPPORT_MATRIX.opencode.minimum}+, or stay on Workit 2.x by pinning "@brainervirus/workit-opencode@2" in the opencode.json "plugin" array`;
   AGENT_MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
   canonicalCursorHook = cursorHooksEntry().command;
@@ -65706,6 +66101,7 @@ var init_doctor = __esm(() => {
     checkMalformedConfig,
     checkWorkspaceMismatch,
     checkWorkspaceLock,
+    checkSessionHook,
     checkCredentialMetadata,
     checkGithubIdentity,
     checkGitLabIdentity,
@@ -65727,20 +66123,20 @@ var init_doctor = __esm(() => {
 import {
   copyFileSync as copyFileSync4,
   cpSync as cpSync4,
-  existsSync as existsSync14,
-  lstatSync as lstatSync5,
-  mkdirSync as mkdirSync6,
+  existsSync as existsSync15,
+  lstatSync as lstatSync6,
+  mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   readdirSync as readdirSync8,
   realpathSync as realpathSync7,
-  renameSync as renameSync3,
-  rmSync as rmSync3,
-  statSync as statSync5,
-  writeFileSync as writeFileSync7
+  renameSync as renameSync4,
+  rmSync as rmSync4,
+  statSync as statSync6,
+  writeFileSync as writeFileSync8
 } from "node:fs";
 import os9 from "node:os";
-import path31 from "node:path";
+import path32 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
 function parseList(raw) {
   return raw.split(",").map((s) => s.trim()).filter(Boolean);
@@ -65784,7 +66180,7 @@ function buildSetupPreview(values, opts = {}) {
     const current = readConfigFromDir(state.configDir);
     mutations.push({
       type: "merge-json",
-      path: path31.join(state.configDir, "config.json"),
+      path: path32.join(state.configDir, "config.json"),
       value: {
         locale: values.locale,
         localeOptions: current.localeOptions,
@@ -65810,17 +66206,17 @@ function buildSetupPreview(values, opts = {}) {
       if (blocked.length === 0) {
         mutations.push({
           type: "update-workspaces",
-          path: path31.join(state.configDir, "workspaces.json"),
+          path: path32.join(state.configDir, "workspaces.json"),
           entries: values.workspaces,
           expectedRevision: diskWorkspaceResult.revision
         });
       }
     }
     if (values.baseUrl.trim()) {
-      const ytPath = path31.join(state.configDir, "youtrack.json");
+      const ytPath = path32.join(state.configDir, "youtrack.json");
       const ytExisting = readConfigRecord(ytPath);
       const ytConfigured = configuredTokenPath(ytExisting, "tokenFile");
-      const tokenPath = resolveTokenPath(ytConfigured, path31.join(state.configDir, "youtrack.token"), values.tokenPaths?.youtrack);
+      const tokenPath = resolveTokenPath(ytConfigured, path32.join(state.configDir, "youtrack.token"), values.tokenPaths?.youtrack);
       const draft = youtrackDraft(values, tokenPath);
       if (ytConfigured !== null && tokenPath !== ytConfigured) {
         delete draft.tokenFile;
@@ -65836,7 +66232,7 @@ function buildSetupPreview(values, opts = {}) {
         path: ytPath,
         value: draft
       });
-      if (existsSync14(tokenPath))
+      if (existsSync15(tokenPath))
         preserved.push(tokenPath);
       else
         mutations.push({
@@ -65848,7 +66244,7 @@ function buildSetupPreview(values, opts = {}) {
         });
     }
     if (values.vcsProvider !== "skip") {
-      const vcsPath = path31.join(state.configDir, "vcs.json");
+      const vcsPath = path32.join(state.configDir, "vcs.json");
       mutations.push({
         type: "merge-json",
         path: vcsPath,
@@ -65877,7 +66273,7 @@ function buildSetupPreview(values, opts = {}) {
             mutations.push({
               type: "install-host",
               platform: "cursor",
-              path: path31.join(paths.home, ".cursor", "plugins", "local", ".workit-package-bootstrap"),
+              path: path32.join(paths.home, ".cursor", "plugins", "local", ".workit-package-bootstrap"),
               commands
             });
           }
@@ -65890,7 +66286,7 @@ function buildSetupPreview(values, opts = {}) {
             mutations.push({
               type: "install-host",
               platform,
-              path: platform === "claude-code" ? claudeInstallRecord(paths.home, env) : platform === "codex" ? path31.join(env.CODEX_HOME ?? path31.join(paths.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : path31.join(env.PI_CODING_AGENT_DIR ?? path31.join(paths.home, ".pi", "agent"), "settings.json"),
+              path: platform === "claude-code" ? claudeInstallRecord(paths.home, env) : platform === "codex" ? path32.join(env.CODEX_HOME ?? path32.join(paths.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : path32.join(env.PI_CODING_AGENT_DIR ?? path32.join(paths.home, ".pi", "agent"), "settings.json"),
               commands
             });
           }
@@ -65898,9 +66294,9 @@ function buildSetupPreview(values, opts = {}) {
       }
     }
     if (values.applyProject) {
-      const root = path31.resolve(opts.cwd ?? process.cwd());
-      const gitignorePath = path31.join(root, ".gitignore");
-      const existing = existsSync14(gitignorePath) ? readFileSync14(gitignorePath, "utf8") : "";
+      const root = path32.resolve(opts.cwd ?? process.cwd());
+      const gitignorePath = path32.join(root, ".gitignore");
+      const existing = existsSync15(gitignorePath) ? readFileSync15(gitignorePath, "utf8") : "";
       const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
       const entries = GITIGNORE_ENTRIES.filter((e) => e.trim() !== "" && !existingLines.has(e.trim()));
@@ -65936,10 +66332,10 @@ function deepMerge(base, patch) {
   return out;
 }
 function applyMutation(m) {
-  const dir = path31.dirname(m.path);
+  const dir = path32.dirname(m.path);
   switch (m.type) {
     case "create-file": {
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
       const res = writeFileExclusive(m.path, m.content, m.mode);
       return res === "created" ? { platform: "core", file: m.path, status: "Installed" } : {
         platform: "core",
@@ -65962,8 +66358,8 @@ function applyMutation(m) {
       if (existing.kind === "record" && JSON.stringify(existing.value) === JSON.stringify(merged)) {
         return { platform: "core", file: m.path, status: "Skipped", detail: "already configured" };
       }
-      mkdirSync6(dir, { recursive: true });
-      writeFileSync7(m.path, JSON.stringify(merged, null, 2) + `
+      mkdirSync7(dir, { recursive: true });
+      writeFileSync8(m.path, JSON.stringify(merged, null, 2) + `
 `, "utf8");
       return existing.kind === "record" ? { platform: "core", file: m.path, status: "Configured" } : { platform: "core", file: m.path, status: "Installed" };
     }
@@ -66004,12 +66400,12 @@ function applyMutation(m) {
 `;
       if (prev === next)
         return { platform: "core", file: m.path, status: "Skipped", detail: "already configured" };
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
       const tmp = `${m.path}.${process.pid}.tmp`;
       try {
-        writeFileSync7(tmp, next, "utf8");
+        writeFileSync8(tmp, next, "utf8");
         if (workspacesRevision(readFileSafe(m.path)) !== m.expectedRevision) {
-          rmSync3(tmp, { force: true });
+          rmSync4(tmp, { force: true });
           return {
             platform: "core",
             file: m.path,
@@ -66017,9 +66413,9 @@ function applyMutation(m) {
             detail: "workspace config changed while applying the preview; rebuild and review it"
           };
         }
-        renameSync3(tmp, m.path);
+        renameSync4(tmp, m.path);
       } catch (error) {
-        rmSync3(tmp, { force: true });
+        rmSync4(tmp, { force: true });
         return {
           platform: "core",
           file: m.path,
@@ -66042,11 +66438,11 @@ function applyMutation(m) {
           detail: "all entries already present"
         };
       }
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
       const separator = existing && !existing.endsWith(`
 `) ? `
 ` : "";
-      writeFileSync7(m.path, existing + separator + (existing ? `
+      writeFileSync8(m.path, existing + separator + (existing ? `
 ` : "") + add.join(`
 `) + `
 `, "utf8");
@@ -66085,8 +66481,8 @@ function applyMutation(m) {
           detail: "already configured"
         };
       }
-      mkdirSync6(path31.dirname(m.path), { recursive: true });
-      writeFileSync7(m.path, JSON.stringify(merged, null, 2) + `
+      mkdirSync7(path32.dirname(m.path), { recursive: true });
+      writeFileSync8(m.path, JSON.stringify(merged, null, 2) + `
 `, "utf8");
       return existing.kind === "record" ? { platform: "core", file: m.path, status: "Configured" } : { platform: "core", file: m.path, status: "Installed" };
     }
@@ -66094,23 +66490,23 @@ function applyMutation(m) {
 }
 function adapterRoot(platform, res, preferInstalledAdapter = false) {
   const candidates = [];
-  const stagedCursor = path31.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap", "node_modules", "@brainervirus", "workit-cursor");
+  const stagedCursor = path32.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap", "node_modules", "@brainervirus", "workit-cursor");
   if (platform === "cursor" && preferInstalledAdapter)
     candidates.push(stagedCursor);
   if (res.dev) {
-    candidates.push(path31.join(res.dev, "packages", `workit-${platform}`));
+    candidates.push(path32.join(res.dev, "packages", `workit-${platform}`));
   } else {
-    candidates.push(path31.join(packageRoot(), "..", `workit-${platform}`));
-    let dir = path31.resolve(res.cwd);
+    candidates.push(path32.join(packageRoot(), "..", `workit-${platform}`));
+    let dir = path32.resolve(res.cwd);
     while (true) {
-      candidates.push(path31.join(dir, "packages", `workit-${platform}`));
-      const parent = path31.dirname(dir);
+      candidates.push(path32.join(dir, "packages", `workit-${platform}`));
+      const parent = path32.dirname(dir);
       if (parent === dir)
         break;
       dir = parent;
     }
   }
-  candidates.push(path31.join(res.home, ".local", "share", "workit", "packages", `workit-${platform}`));
+  candidates.push(path32.join(res.home, ".local", "share", "workit", "packages", `workit-${platform}`));
   if (platform === "cursor")
     candidates.push(stagedCursor);
   for (const candidate of candidates) {
@@ -66129,7 +66525,7 @@ function applyOpenCode(root, res) {
       detail: "workit-opencode package has no loadable plugin entry (src/plugin.ts or dist/plugin.js)"
     };
   }
-  mkdirSync6(path31.dirname(res.opencodeConfig), { recursive: true });
+  mkdirSync7(path32.dirname(res.opencodeConfig), { recursive: true });
   const existing = readExisting(res.opencodeConfig);
   if (existing.kind === "malformed") {
     return {
@@ -66158,7 +66554,7 @@ function applyOpenCode(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync7(res.opencodeConfig, JSON.stringify(merged.config, null, 2) + `
+  writeFileSync8(res.opencodeConfig, JSON.stringify(merged.config, null, 2) + `
 `, "utf8");
   return existing.kind === "record" ? {
     platform: "opencode",
@@ -66174,54 +66570,54 @@ function applyOpenCode(root, res) {
 }
 function copyPluginDir(src, dest) {
   const realSrc = realpathSync7(src);
-  const marker = path31.join(dest, ".workit-root");
-  const destIsLink = existsSync14(dest) && lstatSync5(dest).isSymbolicLink();
+  const marker = path32.join(dest, ".workit-root");
+  const destIsLink = existsSync15(dest) && lstatSync6(dest).isSymbolicLink();
   const synced = !destIsLink && readFileSafe(marker)?.trim() === realSrc && samePluginContent(realSrc, dest, dest);
   if (synced)
     return "Skipped";
-  const hadDir = existsSync14(dest);
+  const hadDir = existsSync15(dest);
   const rules = preservedCursorRules(realSrc, dest);
-  const parent = path31.dirname(dest);
-  mkdirSync6(parent, { recursive: true });
-  const swap = mkdtempSync2(path31.join(parent, `.${path31.basename(dest)}.swap-`));
-  const stage = path31.join(swap, "stage");
-  const backup = path31.join(swap, "backup");
+  const parent = path32.dirname(dest);
+  mkdirSync7(parent, { recursive: true });
+  const swap = mkdtempSync2(path32.join(parent, `.${path32.basename(dest)}.swap-`));
+  const stage = path32.join(swap, "stage");
+  const backup = path32.join(swap, "backup");
   try {
     cpSync4(realSrc, stage, {
       recursive: true,
-      filter: (entry) => !path31.relative(realSrc, entry).split(path31.sep).includes("node_modules")
+      filter: (entry) => !path32.relative(realSrc, entry).split(path32.sep).includes("node_modules")
     });
-    const stagedHooks = path31.join(stage, CURSOR_HOOKS_FILE);
-    if (existsSync14(stagedHooks))
-      writeFileSync7(stagedHooks, localizedCursorHooks(readFileSync14(stagedHooks), dest));
+    const stagedHooks = path32.join(stage, CURSOR_HOOKS_FILE);
+    if (existsSync15(stagedHooks))
+      writeFileSync8(stagedHooks, localizedCursorHooks(readFileSync15(stagedHooks), dest));
     for (const [name, content] of rules) {
-      mkdirSync6(path31.join(stage, "rules"), { recursive: true });
-      writeFileSync7(path31.join(stage, "rules", name), content);
+      mkdirSync7(path32.join(stage, "rules"), { recursive: true });
+      writeFileSync8(path32.join(stage, "rules", name), content);
     }
-    writeFileSync7(path31.join(stage, ".workit-root"), realSrc + `
+    writeFileSync8(path32.join(stage, ".workit-root"), realSrc + `
 `, "utf8");
     if (!samePluginContent(realSrc, stage, dest))
       throw new Error("staged adapter content is incomplete");
-    if (lstatSync5(stage).isSymbolicLink()) {
+    if (lstatSync6(stage).isSymbolicLink()) {
       throw new Error("staged adapter resolved to a symlink — refusing fragile cache install");
     }
     if (hadDir)
-      renameSync3(dest, backup);
+      renameSync4(dest, backup);
     try {
-      renameSync3(stage, dest);
+      renameSync4(stage, dest);
     } catch (error) {
-      if (hadDir && !existsSync14(dest))
-        renameSync3(backup, dest);
+      if (hadDir && !existsSync15(dest))
+        renameSync4(backup, dest);
       throw error;
     }
-    rmSync3(backup, { recursive: true, force: true });
+    rmSync4(backup, { recursive: true, force: true });
   } finally {
-    rmSync3(swap, { recursive: true, force: true });
+    rmSync4(swap, { recursive: true, force: true });
   }
   return hadDir ? "Configured" : "Installed";
 }
 function applyCursorSettings(root, res) {
-  mkdirSync6(path31.dirname(res.cursorSettings), { recursive: true });
+  mkdirSync7(path32.dirname(res.cursorSettings), { recursive: true });
   const settingsExisting = readExisting(res.cursorSettings);
   if (settingsExisting.kind === "malformed") {
     return {
@@ -66240,7 +66636,7 @@ function applyCursorSettings(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync7(res.cursorSettings, JSON.stringify(settings.config, null, 2) + `
+  writeFileSync8(res.cursorSettings, JSON.stringify(settings.config, null, 2) + `
 `, "utf8");
   return {
     platform: "cursor",
@@ -66249,7 +66645,7 @@ function applyCursorSettings(root, res) {
   };
 }
 function applyCursorMcp(root, res) {
-  mkdirSync6(path31.dirname(res.cursorMcp), { recursive: true });
+  mkdirSync7(path32.dirname(res.cursorMcp), { recursive: true });
   const mcpExisting = readExisting(res.cursorMcp);
   if (mcpExisting.kind === "malformed") {
     return {
@@ -66279,7 +66675,7 @@ function applyCursorMcp(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync7(res.cursorMcp, JSON.stringify(mcp.config, null, 2) + `
+  writeFileSync8(res.cursorMcp, JSON.stringify(mcp.config, null, 2) + `
 `, "utf8");
   return {
     platform: "cursor",
@@ -66288,9 +66684,9 @@ function applyCursorMcp(root, res) {
   };
 }
 function verifyPlatform(platform, res) {
-  if (platform === "opencode" && !existsSync14(res.opencodeConfig))
+  if (platform === "opencode" && !existsSync15(res.opencodeConfig))
     return null;
-  if (platform === "cursor" && !existsSync14(res.cursorSettings) && !existsSync14(res.cursorMcp)) {
+  if (platform === "cursor" && !existsSync15(res.cursorSettings) && !existsSync15(res.cursorMcp)) {
     return null;
   }
   return runDoctor({
@@ -66355,7 +66751,7 @@ function applySetupPreview(preview, options = {}) {
   let cursorCopyOk = false;
   for (const mutation of preview.mutations) {
     if (mutation.type === "install-host") {
-      const expectedPath = mutation.platform === "cursor" ? path31.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap") : mutation.platform === "codex" ? path31.join(res.env.CODEX_HOME ?? path31.join(res.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : mutation.platform === "pi" ? path31.join(res.env.PI_CODING_AGENT_DIR ?? path31.join(res.home, ".pi", "agent"), "settings.json") : mutation.platform === "claude-code" ? claudeInstallRecord(res.home, res.env) : "";
+      const expectedPath = mutation.platform === "cursor" ? path32.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap") : mutation.platform === "codex" ? path32.join(res.env.CODEX_HOME ?? path32.join(res.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : mutation.platform === "pi" ? path32.join(res.env.PI_CODING_AGENT_DIR ?? path32.join(res.home, ".pi", "agent"), "settings.json") : mutation.platform === "claude-code" ? claudeInstallRecord(res.home, res.env) : "";
       if (mutation.path !== expectedPath) {
         entries.push({
           platform: mutation.platform,
@@ -66536,12 +66932,12 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return configured ?? fallback;
 }, readConfigRecord = (file) => {
   try {
-    const value = JSON.parse(readFileSync14(file, "utf8"));
+    const value = JSON.parse(readFileSync15(file, "utf8"));
     return isRecord5(value) ? value : null;
   } catch {
     return null;
   }
-}, claudeInstallRecord = (home, env) => path31.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json"), resolveSetupPaths = (options, resolvedConfigDir) => {
+}, claudeInstallRecord = (home, env) => path32.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json"), resolveSetupPaths = (options, resolvedConfigDir) => {
   const env = options.env ?? process.env;
   const home = options.home ?? env.HOME ?? os9.homedir();
   return {
@@ -66549,17 +66945,17 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
     configDir: resolvedConfigDir,
     cwd: options.cwd ?? process.cwd(),
     env,
-    opencodeConfig: options.opencodeConfig ?? path31.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path31.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path31.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path31.join(home, ".cursor", "plugins", "local", "workit")
+    opencodeConfig: options.opencodeConfig ?? path32.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path32.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path32.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path32.join(home, ".cursor", "plugins", "local", "workit")
   };
 }, isRecord5 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readExisting = (p) => {
   let raw;
   try {
-    raw = readFileSync14(p, "utf8");
+    raw = readFileSync15(p, "utf8");
   } catch {
-    if (existsSync14(p))
+    if (existsSync15(p))
       return { kind: "malformed", error: `${p} is not readable` };
     return { kind: "missing" };
   }
@@ -66574,7 +66970,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return { kind: "malformed", error: `${p} is not a JSON object` };
 }, readFileSafe = (p) => {
   try {
-    return readFileSync14(p, "utf8");
+    return readFileSync15(p, "utf8");
   } catch {
     return null;
   }
@@ -66589,7 +66985,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, isAdapter = (root, platform) => {
   try {
-    const pkg = JSON.parse(readFileSync14(path31.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync15(path32.join(root, "package.json"), "utf8"));
     return pkg.name === `@brainervirus/workit-${platform}`;
   } catch {
     return false;
@@ -66603,8 +66999,8 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   if (!isDevOpenCodeAdapterRoot(root, opts.dev))
     return OPENCODE_NPM_PIN;
   for (const rel of ["src/plugin.ts", "dist/plugin.js"]) {
-    const entry = path31.join(root, rel);
-    if (existsSync14(entry))
+    const entry = path32.join(root, rel);
+    if (existsSync15(entry))
       return `file://${entry}`;
   }
   return null;
@@ -66621,22 +67017,22 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
     for (const entry of readdirSync8(src, { withFileTypes: true })) {
       if (entry.name === "node_modules")
         continue;
-      const source = path31.join(src, entry.name);
-      const installed = path31.join(dest, entry.name);
-      const rel = path31.join(relative, entry.name);
+      const source = path32.join(src, entry.name);
+      const installed = path32.join(dest, entry.name);
+      const rel = path32.join(relative, entry.name);
       if (entry.isDirectory()) {
-        if (!statSync5(installed).isDirectory() || !samePluginContent(source, installed, pluginDir, rel))
+        if (!statSync6(installed).isDirectory() || !samePluginContent(source, installed, pluginDir, rel))
           return false;
       } else {
-        const expected = rel === CURSOR_HOOKS_FILE ? localizedCursorHooks(readFileSync14(source), pluginDir) : readFileSync14(source);
-        if (!expected.equals(readFileSync14(installed)))
+        const expected = rel === CURSOR_HOOKS_FILE ? localizedCursorHooks(readFileSync15(source), pluginDir) : readFileSync15(source);
+        if (!expected.equals(readFileSync15(installed)))
           return false;
       }
     }
     for (const entry of readdirSync8(dest, { withFileTypes: true })) {
-      if (existsSync14(path31.join(src, entry.name)))
+      if (existsSync15(path32.join(src, entry.name)))
         continue;
-      const rel = path31.join(relative, entry.name);
+      const rel = path32.join(relative, entry.name);
       if (rel === ".workit-root")
         continue;
       if (relative === "rules" && entry.isFile() && entry.name.endsWith(".mdc"))
@@ -66649,36 +67045,36 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, preservedCursorRules = (src, dest) => {
   const preserved = new Map;
-  const sourceRules = path31.join(src, "rules");
-  const installedRules = path31.join(dest, "rules");
+  const sourceRules = path32.join(src, "rules");
+  const installedRules = path32.join(dest, "rules");
   try {
     for (const entry of readdirSync8(installedRules, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".mdc"))
         continue;
-      if (existsSync14(path31.join(sourceRules, entry.name)))
+      if (existsSync15(path32.join(sourceRules, entry.name)))
         continue;
-      preserved.set(entry.name, readFileSync14(path31.join(installedRules, entry.name)));
+      preserved.set(entry.name, readFileSync15(path32.join(installedRules, entry.name)));
     }
   } catch {}
   return preserved;
 }, removeLegacyCursorDir = (res) => {
-  const legacy = path31.join(res.home, ".cursor", "plugins", "local", "workflow-toolkit");
-  if (legacy === res.cursorPluginDir || !existsSync14(legacy))
+  const legacy = path32.join(res.home, ".cursor", "plugins", "local", "workflow-toolkit");
+  if (legacy === res.cursorPluginDir || !existsSync15(legacy))
     return;
-  const legacyRules = path31.join(legacy, "rules");
-  if (existsSync14(legacyRules)) {
+  const legacyRules = path32.join(legacy, "rules");
+  if (existsSync15(legacyRules)) {
     try {
-      mkdirSync6(path31.join(res.cursorPluginDir, "rules"), { recursive: true });
+      mkdirSync7(path32.join(res.cursorPluginDir, "rules"), { recursive: true });
       for (const entry of readdirSync8(legacyRules, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".mdc"))
           continue;
-        const target = path31.join(res.cursorPluginDir, "rules", entry.name);
-        if (!existsSync14(target))
-          copyFileSync4(path31.join(legacyRules, entry.name), target);
+        const target = path32.join(res.cursorPluginDir, "rules", entry.name);
+        if (!existsSync15(target))
+          copyFileSync4(path32.join(legacyRules, entry.name), target);
       }
     } catch {}
   }
-  rmSync3(legacy, { recursive: true, force: true });
+  rmSync4(legacy, { recursive: true, force: true });
 }, failedDetail = (report) => report.checks.filter((c) => c.status === "fail").map((c) => `${c.id}: ${c.detail}`).join("; "), setupCompletionGuidance = () => [
   "Run `workit doctor` to verify your installation.",
   "Run /wk-status in OpenCode to review token setup steps."
@@ -66708,16 +67104,16 @@ var init_setup = __esm(() => {
     { envKey: "WORKFLOW_GITHUB_HOST", affects: "vcs.json github.host" }
   ];
   SETUP_OVERRIDES = [...YT_OVERRIDES, ...VCS_OVERRIDES];
-  CURSOR_HOOKS_FILE = path31.join("hooks", "hooks-cursor.json");
+  CURSOR_HOOKS_FILE = path32.join("hooks", "hooks-cursor.json");
 });
 
 // packages/workit-core/src/core/workspace-branch-policy.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
-import path32 from "node:path";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync16, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "node:fs";
+import path33 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 function applyWorkspaceBranchPolicy(opts) {
   const { workspace_root, env = process.env } = opts;
-  const dir = path32.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const dir = path33.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
   const {
     status,
     path: wsPath,
@@ -66729,7 +67125,7 @@ function applyWorkspaceBranchPolicy(opts) {
   if (status === "malformed" || status === "invalid")
     return { ok: false, error: workspacesError ?? `invalid workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
-  const name = String(env.WORKFLOW_BP_NAME ?? path32.basename(workspace_root));
+  const name = String(env.WORKFLOW_BP_NAME ?? path33.basename(workspace_root));
   const integration = env.WORKFLOW_BP_INTEGRATION ?? detection.integration;
   const policy = {
     preset: detection.preset,
@@ -66778,22 +67174,22 @@ function applyWorkspaceBranchPolicy(opts) {
       ok: false,
       error: `workspaces.json changed while applying the branch policy: ${wsPath}`
     };
-  mkdirSync7(path32.dirname(wsPath), { recursive: true });
+  mkdirSync8(path33.dirname(wsPath), { recursive: true });
   const tmp = `${wsPath}.${process.pid}.tmp`;
   try {
-    writeFileSync8(tmp, JSON.stringify({ ...document2, workspaces: next }, null, 2) + `
+    writeFileSync9(tmp, JSON.stringify({ ...document2, workspaces: next }, null, 2) + `
 `, "utf8");
     if (workspacesRevision(readFileSafe2(wsPath)) !== revision) {
-      rmSync4(tmp, { force: true });
+      rmSync5(tmp, { force: true });
       return {
         ok: false,
         error: `workspaces.json changed while applying the branch policy: ${wsPath}`
       };
     }
-    renameSync4(tmp, wsPath);
+    renameSync5(tmp, wsPath);
   } catch (error) {
     try {
-      rmSync4(tmp, { force: true });
+      rmSync5(tmp, { force: true });
     } catch {}
     return {
       ok: false,
@@ -66810,7 +67206,7 @@ function applyWorkspaceBranchPolicy(opts) {
 }
 var readFileSafe2 = (p) => {
   try {
-    return readFileSync15(p, "utf8");
+    return readFileSync16(p, "utf8");
   } catch {
     return null;
   }
@@ -67062,8 +67458,8 @@ var init_logic = __esm(() => {
 });
 
 // packages/workit-cli/src/wizard-state.ts
-import { existsSync as existsSync15, statSync as statSync6 } from "node:fs";
-import path33 from "node:path";
+import { existsSync as existsSync16, statSync as statSync7 } from "node:fs";
+import path34 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "node:util";
 function resolveBasePath(values, env = process.env) {
   return env.WORKFLOW_WORKSPACE_ROOT?.trim() || values.basePath.trim();
@@ -67582,7 +67978,7 @@ function workspaceDraftText(draft, field, value) {
 }
 var NEXT, PREV, skipsCustomBranch = (screen, preset) => (screen === "branchAllowed" || screen === "branchProtected") && preset !== "custom", skipsYoutrack = (screen, tracker) => screen === "youtrack" && tracker !== "youtrack", skipsBasePath = (screen, basePath) => screen === "basePath" && basePath !== "", isDirectory = (p) => {
   try {
-    return statSync6(p).isDirectory();
+    return statSync7(p).isDirectory();
   } catch {
     return false;
   }
@@ -67590,8 +67986,8 @@ var NEXT, PREV, skipsCustomBranch = (screen, preset) => (screen === "branchAllow
   const p = value.trim();
   if (!p)
     return "workspace root path is required";
-  return !path33.isAbsolute(p) || !isDirectory(p) ? `invalid workspace root "${p}" — enter an existing absolute directory` : null;
-}, skipsBranchPolicy = (screen, basePath) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync15(path33.join(basePath, ".git")), decodeBranchPreset = (value, fallback) => value === "gitflow" || value === "github-flow" || value === "trunk-based" || value === "custom" ? value : fallback, decodeVcsProvider = (value, fallback) => value === "gitlab" || value === "github" || value === "skip" ? value : fallback, decodeIssueTracker = (value, fallback) => value === "youtrack" || value === "github" || value === "gitlab" || value === "none" ? value : fallback, GITHUB_ISSUES, withGithubIssues = (draft, tracker) => tracker === "github" ? { ...draft, issues: { ...GITHUB_ISSUES } } : draft;
+  return !path34.isAbsolute(p) || !isDirectory(p) ? `invalid workspace root "${p}" — enter an existing absolute directory` : null;
+}, skipsBranchPolicy = (screen, basePath) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync16(path34.join(basePath, ".git")), decodeBranchPreset = (value, fallback) => value === "gitflow" || value === "github-flow" || value === "trunk-based" || value === "custom" ? value : fallback, decodeVcsProvider = (value, fallback) => value === "gitlab" || value === "github" || value === "skip" ? value : fallback, decodeIssueTracker = (value, fallback) => value === "youtrack" || value === "github" || value === "gitlab" || value === "none" ? value : fallback, GITHUB_ISSUES, withGithubIssues = (draft, tracker) => tracker === "github" ? { ...draft, issues: { ...GITHUB_ISSUES } } : draft;
 var init_wizard_state = __esm(() => {
   init_config();
   init_workspaces();
@@ -67650,9 +68046,9 @@ var init_wizard_state = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/uninstall.ts
-import { existsSync as existsSync16, readFileSync as readFileSync16, realpathSync as realpathSync8, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync17, realpathSync as realpathSync8, rmSync as rmSync6, writeFileSync as writeFileSync10 } from "node:fs";
 import os10 from "node:os";
-import path34 from "node:path";
+import path35 from "node:path";
 function cleanCursorSettings(settings, pluginDir) {
   const next = { ...settings };
   let changed = false;
@@ -67752,7 +68148,7 @@ function planUninstall(paths = {}) {
   const mcpExisting = readJsonRecord(res.cursorMcp);
   const settingsDirty = settingsExisting.kind === "malformed" || settingsExisting.kind === "record" && cleanCursorSettings(settingsExisting.value, res.cursorPluginDir).changed;
   const mcpDirty = mcpExisting.kind === "malformed" || mcpExisting.kind === "record" && cleanCursorMcp(mcpExisting.value).changed;
-  const dirExists = existsSync16(res.cursorPluginDir);
+  const dirExists = existsSync17(res.cursorPluginDir);
   const actions = [];
   if (settingsDirty) {
     actions.push({
@@ -67780,7 +68176,7 @@ function planUninstall(paths = {}) {
     installed: settingsDirty || mcpDirty || dirExists,
     actions
   };
-  const codexInstalled = existsSync16(res.codexPluginDir);
+  const codexInstalled = existsSync17(res.codexPluginDir);
   const codex = {
     host: "codex",
     installed: codexInstalled,
@@ -67827,17 +68223,17 @@ function applyUninstall(plan, paths = {}) {
         status = outcome.status;
         detail = outcome.detail;
       } else if (action.kind === "remove-dir") {
-        const resolved = path34.resolve(action.path);
-        const allowed = canonicalRemoveDirAllowed(resolved, res) || resolved === path34.resolve(res.codexPluginDir) && path34.basename(resolved) === "workit" && path34.basename(path34.dirname(resolved)) === "plugins";
+        const resolved = path35.resolve(action.path);
+        const allowed = canonicalRemoveDirAllowed(resolved, res) || resolved === path35.resolve(res.codexPluginDir) && path35.basename(resolved) === "workit" && path35.basename(path35.dirname(resolved)) === "plugins";
         if (!allowed) {
           status = "failed";
           detail = `refusing to remove non-canonical plugin directory: ${resolved}`;
-        } else if (!existsSync16(resolved)) {
+        } else if (!existsSync17(resolved)) {
           status = "skipped";
           detail = "directory already absent";
         } else {
           try {
-            rmSync5(resolved, { recursive: true, force: true });
+            rmSync6(resolved, { recursive: true, force: true });
             status = "removed";
           } catch (error) {
             status = "failed";
@@ -67863,19 +68259,19 @@ function applyUninstall(plan, paths = {}) {
 var resolveUninstallPaths = (options = {}) => {
   const home = options.home ?? options.env?.HOME ?? os10.homedir();
   return {
-    opencodeConfig: options.opencodeConfig ?? path34.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path34.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path34.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path34.join(home, ".cursor", "plugins", "local", "workit"),
-    codexPluginDir: path34.join(home, ".codex", "plugins", "workit"),
-    piConfig: path34.join(home, ".pi", "config.json")
+    opencodeConfig: options.opencodeConfig ?? path35.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path35.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path35.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path35.join(home, ".cursor", "plugins", "local", "workit"),
+    codexPluginDir: path35.join(home, ".codex", "plugins", "workit"),
+    piConfig: path35.join(home, ".pi", "config.json")
   };
 }, isRecord6 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readJsonRecord = (file) => {
   let raw;
   try {
-    raw = readFileSync16(file, "utf8");
+    raw = readFileSync17(file, "utf8");
   } catch {
-    if (existsSync16(file))
+    if (existsSync17(file))
       return { kind: "malformed", error: `${file} is not readable` };
     return { kind: "missing" };
   }
@@ -67886,8 +68282,8 @@ var resolveUninstallPaths = (options = {}) => {
     return { kind: "malformed", error: `${file} is not valid JSON` };
   }
 }, stripTrailingSep = (p) => {
-  const j = path34.join(p);
-  return path34.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
+  const j = path35.join(p);
+  return path35.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
 }, CURSOR_LEGACY_IDENTITIES, jsonCleanerFor = (target, res) => {
   if (target === res.opencodeConfig)
     return cleanOpenCodeConfig;
@@ -67899,8 +68295,8 @@ var resolveUninstallPaths = (options = {}) => {
     return cleanPiConfig;
   return null;
 }, canonicalRemoveDirAllowed = (actionPath, res) => {
-  const expected = path34.resolve(res.cursorPluginDir);
-  if (!(actionPath === expected && path34.basename(expected) === "workit" && path34.basename(path34.dirname(expected)) === "local" && path34.basename(path34.dirname(path34.dirname(expected))) === "plugins")) {
+  const expected = path35.resolve(res.cursorPluginDir);
+  if (!(actionPath === expected && path35.basename(expected) === "workit" && path35.basename(path35.dirname(expected)) === "local" && path35.basename(path35.dirname(path35.dirname(expected))) === "plugins")) {
     return false;
   }
   try {
@@ -67923,7 +68319,7 @@ var resolveUninstallPaths = (options = {}) => {
 `;
   let current;
   try {
-    current = readFileSync16(target, "utf8");
+    current = readFileSync17(target, "utf8");
   } catch (error) {
     return {
       status: "failed",
@@ -67934,7 +68330,7 @@ var resolveUninstallPaths = (options = {}) => {
     return { status: "skipped", detail: "already clean" };
   }
   try {
-    writeFileSync9(target, serialized, "utf8");
+    writeFileSync10(target, serialized, "utf8");
   } catch (error) {
     return {
       status: "failed",
@@ -67952,7 +68348,7 @@ var resolveUninstallPaths = (options = {}) => {
     };
   const home = paths.home ?? paths.env?.HOME ?? os10.homedir();
   const env = paths.env ?? process.env;
-  const recorded = claudeWorkitInstalls(home, env, action.cwd).some((install) => install.id === id && install.scope === scope && (install.projectPath === null ? action.cwd === null : path34.resolve(install.projectPath) === path34.resolve(action.cwd ?? "")));
+  const recorded = claudeWorkitInstalls(home, env, action.cwd).some((install) => install.id === id && install.scope === scope && (install.projectPath === null ? action.cwd === null : path35.resolve(install.projectPath) === path35.resolve(action.cwd ?? "")));
   if (!recorded)
     return { status: "skipped", detail: `${id} (${scope} scope) is no longer installed` };
   const executable = findHostExecutable("claude", { home, env });
@@ -70431,9 +70827,9 @@ var init_src2 = __esm(async () => {
 // packages/workit-cli/src/verbs/init.ts
 var exports_init = {};
 __export(exports_init, {
-  run: () => run2
+  run: () => run3
 });
-async function run2(_argv, io) {
+async function run3(_argv, io) {
   if (io.json)
     return emit(io, fail("invalid_input", "workit init is an interactive wizard and has no --json output", {
       unblock: "run `workit init` in a terminal without --json"
@@ -70447,19 +70843,19 @@ var init_init = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
+import { spawnSync as spawnSync15 } from "node:child_process";
 import {
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   mkdtempSync as mkdtempSync3,
-  rmSync as rmSync6,
-  readFileSync as readFileSync17,
-  mkdirSync as mkdirSync8,
+  rmSync as rmSync7,
+  readFileSync as readFileSync18,
+  mkdirSync as mkdirSync9,
   copyFileSync as copyFileSync5,
-  chmodSync,
+  chmodSync as chmodSync2,
   cpSync as cpSync5,
-  lstatSync as lstatSync6
+  lstatSync as lstatSync7
 } from "node:fs";
-import path35 from "node:path";
+import path36 from "node:path";
 import os12 from "node:os";
 import { createHash as createHash14 } from "node:crypto";
 function previewUpgrade(hosts = HOSTS2, deps = {}) {
@@ -70483,9 +70879,9 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
   for (const file of [
     paths.opencodeConfig,
     paths.opencodeConfig + "c",
-    path35.join(home, ".cursor/settings.json"),
-    path35.join(home, ".cursor/mcp.json"),
-    path35.join(home, ".cursor/plugins/local/workit/package.json"),
+    path36.join(home, ".cursor/settings.json"),
+    path36.join(home, ".cursor/mcp.json"),
+    path36.join(home, ".cursor/plugins/local/workit/package.json"),
     paths.codexConfig,
     paths.piSettings
   ])
@@ -70500,20 +70896,20 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
       });
     const installedSources = sources(paths, run, hosts);
     if (installedSources.some((source) => source.host === "opencode")) {
-      const scratch = mkdtempSync3(path35.join(os12.tmpdir(), "workit-upgrade-opencode-"));
+      const scratch = mkdtempSync3(path36.join(os12.tmpdir(), "workit-upgrade-opencode-"));
       let probe;
       try {
         probe = runner({
           ...deps,
           env: {
             ...deps.env,
-            XDG_DATA_HOME: path35.join(scratch, "data"),
-            XDG_STATE_HOME: path35.join(scratch, "state"),
-            XDG_CACHE_HOME: path35.join(scratch, "cache")
+            XDG_DATA_HOME: path36.join(scratch, "data"),
+            XDG_STATE_HOME: path36.join(scratch, "state"),
+            XDG_CACHE_HOME: path36.join(scratch, "cache")
           }
         })("opencode", ["--version"]);
       } finally {
-        rmSync6(scratch, { recursive: true, force: true });
+        rmSync7(scratch, { recursive: true, force: true });
       }
       const installed = probe.status === 0 ? probe.stdout.match(/\d+\.\d+\.\d+/)?.[0] : undefined;
       if (installed && !versionAtLeast(installed, SUPPORT_MATRIX.opencode.minimum))
@@ -70555,7 +70951,7 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
         env: deps.env,
         cwd: home,
         packageVersion: latest.stdout.trim(),
-        targetDir: path35.join(home, ".cursor/plugins/local/workit")
+        targetDir: path36.join(home, ".cursor/plugins/local/workit")
       });
       plan.entries.push({
         host: source.host,
@@ -70585,13 +70981,13 @@ function applyUpgrade(plan, deps = {}) {
       ok: false,
       error: "Stop the selected running hosts before upgrading their loaded plugins"
     };
-  const backup = path35.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
-  mkdirSync8(backup, { recursive: true, mode: 448 });
+  const backup = path36.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
+  mkdirSync9(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
-    if (existsSync17(file)) {
-      const target = path35.join(backup, createHash14("sha256").update(file).digest("hex").slice(0, 12) + "-" + path35.basename(file));
+    if (existsSync18(file)) {
+      const target = path36.join(backup, createHash14("sha256").update(file).digest("hex").slice(0, 12) + "-" + path36.basename(file));
       copyFileSync5(file, target);
-      chmodSync(target, 384);
+      chmodSync2(target, 384);
     }
   for (const migration of plan.migrations) {
     const value = object2(migration.file);
@@ -70606,9 +71002,9 @@ function applyUpgrade(plan, deps = {}) {
 `, 384);
   }
   const run = runner(deps);
-  const cursorRoot = path35.join(home, ".cursor/plugins/local/workit");
-  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync17(cursorRoot))
-    cpSync5(cursorRoot, path35.join(backup, "cursor-package"), { recursive: true });
+  const cursorRoot = path36.join(home, ".cursor/plugins/local/workit");
+  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync18(cursorRoot))
+    cpSync5(cursorRoot, path36.join(backup, "cursor-package"), { recursive: true });
   for (const entry of plan.entries) {
     if (entry.host === "opencode")
       return {
@@ -70628,7 +71024,7 @@ function applyUpgrade(plan, deps = {}) {
           {
             type: "install-host",
             platform: "cursor",
-            path: path35.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
+            path: path36.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
             commands: entry.commands.map((command) => ({
               ...command,
               purpose: command.purpose ?? "Upgrade Cursor"
@@ -70637,7 +71033,7 @@ function applyUpgrade(plan, deps = {}) {
           {
             type: "install-adapter",
             platform: "cursor",
-            path: path35.join(home, ".cursor/plugins/local/workit")
+            path: path36.join(home, ".cursor/plugins/local/workit")
           }
         ]
       };
@@ -70651,7 +71047,7 @@ function applyUpgrade(plan, deps = {}) {
           return { exitCode: outcome.status ?? 1, stdout: outcome.stdout, stderr: "" };
         }
       });
-      const pkg = object2(path35.join(home, ".cursor/plugins/local/workit/package.json"));
+      const pkg = object2(path36.join(home, ".cursor/plugins/local/workit/package.json"));
       if (!result.ok || pkg?.version !== entry.latest)
         return {
           ok: false,
@@ -70685,15 +71081,15 @@ function applyUpgrade(plan, deps = {}) {
     const currentRoot = run("npm", ["root", "--global"]);
     if (currentRoot.status !== 0 || currentRoot.stdout.trim() !== plan.cli.root)
       return { ok: false, backup, error: "Global npm location changed; preview again" };
-    const cliBackup = path35.join(backup, "cli-package");
-    cpSync5(path35.join(plan.cli.root, "@brainervirus/workit-cli"), cliBackup, { recursive: true });
+    const cliBackup = path36.join(backup, "cli-package");
+    cpSync5(path36.join(plan.cli.root, "@brainervirus/workit-cli"), cliBackup, { recursive: true });
     if (run("npm", ["install", "--global", `@brainervirus/workit-cli@${plan.cli.latest}`]).status !== 0)
       return {
         ok: false,
         backup,
-        error: `CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path35.join(cliBackup, "dist/index.js")}`
+        error: `CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path36.join(cliBackup, "dist/index.js")}`
       };
-    const installed = object2(path35.join(plan.cli.root, "@brainervirus/workit-cli/package.json"));
+    const installed = object2(path36.join(plan.cli.root, "@brainervirus/workit-cli/package.json"));
     if (installed?.name !== "@brainervirus/workit-cli" || installed.version !== plan.cli.latest)
       return {
         ok: false,
@@ -70718,12 +71114,12 @@ async function runUpgradeCommand(argv, deps = {}) {
   if (flags.has("--cli")) {
     const run = runner(deps);
     const root = run("npm", ["root", "--global"]);
-    if (root.status !== 0 || !path35.isAbsolute(root.stdout.trim())) {
+    if (root.status !== 0 || !path36.isAbsolute(root.stdout.trim())) {
       plan.blocked.push("Global npm location could not be verified");
     } else {
-      const packageFile = path35.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
+      const packageFile = path36.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
       const pkg = object2(packageFile);
-      if (pkg?.name !== "@brainervirus/workit-cli" || lstatSync6(path35.dirname(packageFile)).isSymbolicLink()) {
+      if (pkg?.name !== "@brainervirus/workit-cli" || lstatSync7(path36.dirname(packageFile)).isSymbolicLink()) {
         plan.skipped.push({
           host: "cli",
           reason: "No managed global CLI install (local links preserved); use npx @brainervirus/workit-cli@latest"
@@ -70803,7 +71199,7 @@ async function runLaunchCommand(argv, deps = {}) {
   }
   if (deps.run)
     return deps.run(host, hostArgs).status ?? 1;
-  return spawnSync14(launch.command, launch.args, {
+  return spawnSync15(launch.command, launch.args, {
     stdio: "inherit",
     env
   }).status ?? 1;
@@ -70814,37 +71210,37 @@ var HOSTS2, upgradePaths = (deps) => {
     ...process.env,
     ...deps.home || deps.env?.HOME ? {
       HOME: home,
-      CODEX_HOME: path35.join(home, ".codex"),
-      PI_CODING_AGENT_DIR: path35.join(home, ".pi/agent"),
-      XDG_CONFIG_HOME: path35.join(home, ".config"),
+      CODEX_HOME: path36.join(home, ".codex"),
+      PI_CODING_AGENT_DIR: path36.join(home, ".pi/agent"),
+      XDG_CONFIG_HOME: path36.join(home, ".config"),
       WORKFLOW_TOOLKIT_CONFIG: undefined,
       WORKFLOW_TOOLKIT_CONFIG_DIR: undefined
     } : {},
     ...deps.env,
     HOME: home
   };
-  const xdg = env.XDG_CONFIG_HOME || path35.join(home, ".config");
+  const xdg = env.XDG_CONFIG_HOME || path36.join(home, ".config");
   return {
     home,
     env,
-    configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path35.join(xdg, "workit"),
-    opencodeConfig: path35.join(xdg, "opencode/opencode.json"),
-    piSettings: path35.join(env.PI_CODING_AGENT_DIR ?? path35.join(home, ".pi/agent"), "settings.json"),
-    codexConfig: path35.join(env.CODEX_HOME ?? path35.join(home, ".codex"), "config.toml")
+    configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path36.join(xdg, "workit"),
+    opencodeConfig: path36.join(xdg, "opencode/opencode.json"),
+    piSettings: path36.join(env.PI_CODING_AGENT_DIR ?? path36.join(home, ".pi/agent"), "settings.json"),
+    codexConfig: path36.join(env.CODEX_HOME ?? path36.join(home, ".codex"), "config.toml")
   };
 }, object2 = (file) => {
-  if (!existsSync17(file))
+  if (!existsSync18(file))
     return null;
   let data;
   try {
-    data = JSON.parse(readFileSync17(file, "utf8"));
+    data = JSON.parse(readFileSync18(file, "utf8"));
   } catch {
     throw new Error(`${file} is not valid JSON; use the native host to inspect JSONC settings`);
   }
   if (!data || typeof data !== "object" || Array.isArray(data))
     throw new Error(`${file} is not a configuration object`);
   return data;
-}, digest2 = (file) => existsSync17(file) ? createHash14("sha256").update(readFileSync17(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
+}, digest2 = (file) => existsSync18(file) ? createHash14("sha256").update(readFileSync18(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
   const { home, env } = upgradePaths(deps);
   let step;
   try {
@@ -70861,7 +71257,7 @@ var HOSTS2, upgradePaths = (deps) => {
 }), sources = (paths, run, hosts) => {
   const { home, opencodeConfig, piSettings } = paths;
   const result = [];
-  if (hosts.includes("opencode") && existsSync17(opencodeConfig + "c"))
+  if (hosts.includes("opencode") && existsSync18(opencodeConfig + "c"))
     throw new Error("OpenCode JSONC config is present; inspect effective native configuration before updating");
   const oc = hosts.includes("opencode") ? object2(opencodeConfig) : null;
   if (oc && [oc.plugins, oc.plugin].some((value) => value !== undefined && !Array.isArray(value)))
@@ -70870,9 +71266,9 @@ var HOSTS2, upgradePaths = (deps) => {
   for (const pin of plugins)
     if (typeof pin === "string" && isWorkitPlugin(pin))
       result.push(classify("opencode", pin));
-  const cursor = hosts.includes("cursor") ? object2(path35.join(home, ".cursor/plugins/local/workit/package.json")) : null;
+  const cursor = hosts.includes("cursor") ? object2(path36.join(home, ".cursor/plugins/local/workit/package.json")) : null;
   if (cursor?.name === "@brainervirus/workit-cursor") {
-    const mcp = object2(path35.join(home, ".cursor/mcp.json"));
+    const mcp = object2(path36.join(home, ".cursor/mcp.json"));
     const args = mcp?.mcpServers?.workit?.args ?? [];
     const selector = args.find((arg) => typeof arg === "string" && arg.startsWith("--package="));
     result.push(classify("cursor", typeof selector === "string" ? selector.slice(10) : "local"));
@@ -70885,7 +71281,7 @@ var HOSTS2, upgradePaths = (deps) => {
     if (typeof source !== "string")
       continue;
     const npm = /^(?:npm:)?@brainervirus\/workit-pi(?:@[^/]+)?$/.test(source);
-    const local = path35.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path35.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
+    const local = path36.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path36.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
     if (npm || local)
       result.push(classify("pi", source));
   }
@@ -70896,7 +71292,7 @@ var HOSTS2, upgradePaths = (deps) => {
       hostCommand("codex", [], { home, env: paths.env });
       available = true;
     } catch {}
-    if (available || existsSync17(paths.codexConfig))
+    if (available || existsSync18(paths.codexConfig))
       throw new Error("Codex plugin inventory failed; inspect the native host before upgrading");
   }
   if (listing.status === 0) {
@@ -70932,9 +71328,9 @@ var HOSTS2, upgradePaths = (deps) => {
 }, piInstalledVersion = (listing, selector) => {
   const lines = listing.split(/\r?\n/).map((line) => line.trim());
   const index = lines.indexOf(selector);
-  if (index < 0 || !lines[index + 1] || !path35.isAbsolute(lines[index + 1]))
+  if (index < 0 || !lines[index + 1] || !path36.isAbsolute(lines[index + 1]))
     return;
-  const pkg = object2(path35.join(lines[index + 1], "package.json"));
+  const pkg = object2(path36.join(lines[index + 1], "package.json"));
   return pkg?.name === "@brainervirus/workit-pi" ? pkg.version : undefined;
 }, versionAtLeast = (installed, latest) => {
   if (!/^\d+\.\d+\.\d+$/.test(installed))
@@ -70967,9 +71363,9 @@ var init_upgrade = __esm(() => {
 // packages/workit-cli/src/verbs/upgrade.ts
 var exports_upgrade = {};
 __export(exports_upgrade, {
-  run: () => run3
+  run: () => run4
 });
-var run3 = (argv) => runUpgradeCommand(argv);
+var run4 = (argv) => runUpgradeCommand(argv);
 var init_upgrade2 = __esm(() => {
   init_upgrade();
 });
@@ -70977,17 +71373,17 @@ var init_upgrade2 = __esm(() => {
 // packages/workit-cli/src/verbs/launch.ts
 var exports_launch = {};
 __export(exports_launch, {
-  run: () => run4
+  run: () => run5
 });
-var run4 = (argv) => runLaunchCommand(argv);
+var run5 = (argv) => runLaunchCommand(argv);
 var init_launch = __esm(() => {
   init_upgrade();
 });
 
 // packages/workit-core/src/knowledge.ts
-import { spawnSync as spawnSync15 } from "node:child_process";
+import { spawnSync as spawnSync16 } from "node:child_process";
 import fs17 from "node:fs";
-import path36 from "node:path";
+import path37 from "node:path";
 function lintKnowledge(root) {
   const seen = new Set;
   const unreadable = [];
@@ -71091,7 +71487,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   const end = lines.indexOf("---", 1);
   return end === -1 ? lines : [...lines.slice(0, end + 1).map(() => ""), ...lines.slice(end + 1)];
 }, read = (root, file) => {
-  const full = path36.join(root, file);
+  const full = path37.join(root, file);
   try {
     fs17.lstatSync(full);
   } catch {
@@ -71106,7 +71502,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
     return "unreadable";
   }
 }, trackedTopLevel = (root) => {
-  const run = spawnSync15("git", ["ls-files", "-z", "--cached"], {
+  const run = spawnSync16("git", ["ls-files", "-z", "--cached"], {
     cwd: root,
     encoding: "utf8",
     maxBuffer: 256 * 1024 * 1024,
@@ -71116,7 +71512,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   if (run.status !== 0)
     return null;
   return new Set(run.stdout.split("\x00").filter(Boolean).map((file) => file.split("/")[0]));
-}, exists = (target) => {
+}, exists2 = (target) => {
   try {
     fs17.statSync(target);
     return true;
@@ -71132,7 +71528,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   }
 }, brokenLinks = (root, doc, tracked) => {
   const findings = [];
-  const base = path36.dirname(path36.join(root, doc.file));
+  const base = path37.dirname(path37.join(root, doc.file));
   const missing = (target, line, how) => findings.push({
     rule: "broken-link",
     file: doc.file,
@@ -71151,8 +71547,8 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
       const local = localTarget(target);
       if (!local)
         continue;
-      const resolved = local.startsWith("/") ? path36.join(root, local) : path36.resolve(base, local);
-      if (!exists(resolved))
+      const resolved = local.startsWith("/") ? path37.join(root, local) : path37.resolve(base, local);
+      if (!exists2(resolved))
         missing(target, index + 1, "link");
     }
     for (const [, span] of text.matchAll(CODE_SPAN)) {
@@ -71161,10 +71557,10 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
         continue;
       const relative = /^\.\.?\//.test(candidate);
       const first = candidate.split("/")[0];
-      if (!relative && !(tracked ? tracked.has(first) : exists(path36.join(root, first))))
+      if (!relative && !(tracked ? tracked.has(first) : exists2(path37.join(root, first))))
         continue;
-      const resolved = relative ? path36.resolve(base, candidate) : path36.join(root, candidate);
-      if (!exists(resolved))
+      const resolved = relative ? path37.resolve(base, candidate) : path37.join(root, candidate);
+      if (!exists2(resolved))
         missing(span, index + 1, "pointer");
     }
   }
@@ -71289,7 +71685,7 @@ var init_prompt = () => {};
 // packages/workit-cli/src/verbs/doctor.ts
 var exports_doctor = {};
 __export(exports_doctor, {
-  run: () => run5
+  run: () => run6
 });
 async function confirmForcedLockClear(root, args, io) {
   const lock = inspectMetadataLock(root);
@@ -71312,7 +71708,7 @@ async function confirmForcedLockClear(root, args, io) {
     return "cancelled";
   return /^y(es)?$/i.test(answer.trim());
 }
-async function run5(argv, io) {
+async function run6(argv, io) {
   const root = workspaceRootFor();
   const force = argv.includes("--force");
   let fixLock = null;
@@ -71330,6 +71726,18 @@ async function run5(argv, io) {
     }
     fixLock = clearStaleMetadataLock(root, { force });
   }
+  let sessionHook = null;
+  if (argv.includes("--fix")) {
+    try {
+      const fixed = fixSessionHook({ host: "cli", cwd: io.cwd, workspaceRoot: root });
+      sessionHook = { action: fixed.action, detail: fixed.detail };
+    } catch (error) {
+      sessionHook = {
+        action: "failed",
+        detail: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
   const report = runDoctor({
     host: "cli",
     cwd: io.cwd,
@@ -71352,7 +71760,7 @@ async function run5(argv, io) {
       budget: knowledge.budget,
       findings: knowledge.findings.length
     } : { unavailable: true };
-    io.stdout(`${JSON.stringify({ ...report, ...fixLock ? { fixLock } : {}, knowledge: summary }, null, 2)}
+    io.stdout(`${JSON.stringify({ ...report, ...fixLock ? { fixLock } : {}, ...sessionHook ? { sessionHook } : {}, knowledge: summary }, null, 2)}
 `);
     return report.exitCode;
   }
@@ -71361,6 +71769,9 @@ async function run5(argv, io) {
     io.stdout(`fix-lock: ${what}${fixLock.guardCleared ? "; removed abandoned reclaim guard" : ""}
 `);
   }
+  if (sessionHook)
+    io.stdout(`fix: session hook ${sessionHook.action}: ${sessionHook.detail}
+`);
   io.stdout(`workit doctor — ${report.ok ? "healthy" : "problems found"} (${report.offline ? "offline" : "online"})
 `);
   for (const check of report.checks) {
@@ -71493,11 +71904,11 @@ var init_redact = __esm(() => {
 });
 
 // packages/workit-core/src/checks.ts
-import { spawn, spawnSync as spawnSync16 } from "node:child_process";
+import { spawn, spawnSync as spawnSync17 } from "node:child_process";
 import { createHash as createHash15 } from "node:crypto";
 import fs18 from "node:fs";
 import os13 from "node:os";
-import path37 from "node:path";
+import path38 from "node:path";
 import { StringDecoder } from "node:string_decoder";
 function tailLines(text, lines = TAIL_LINES) {
   const all = text.replace(/\r\n?/gu, `
@@ -71617,7 +72028,7 @@ function planSpawn(argv, options) {
     return { file: argv[0], args: [], verbatim: false, shell: true };
   if (options.platform !== "win32")
     return { file: argv[0], args: argv.slice(1), verbatim: false, shell: false };
-  const win = path37.win32;
+  const win = path38.win32;
   const isFile = options.isFile ?? ((file) => {
     try {
       return fs18.statSync(file).isFile();
@@ -71672,7 +72083,7 @@ function runCheckCommand(argv, options) {
       if (!child?.pid)
         return;
       if (windows)
-        spawnSync16("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+        spawnSync17("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
           stdio: "ignore",
           windowsHide: true
         });
@@ -71774,10 +72185,10 @@ function runCheckCommand(argv, options) {
 function storeLog(storeRoot, log) {
   const digest = logDigest(log);
   const ref = `blobs/logs/${digest.slice("sha256:".length)}.log`;
-  const file = path37.join(storeRoot, ref);
+  const file = path38.join(storeRoot, ref);
   try {
     if (!fs18.existsSync(file)) {
-      fs18.mkdirSync(path37.dirname(file), { recursive: true });
+      fs18.mkdirSync(path38.dirname(file), { recursive: true });
       const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
       fs18.writeFileSync(temp, log, { mode: 384 });
       fs18.renameSync(temp, file);
@@ -71790,7 +72201,7 @@ function storeLog(storeRoot, log) {
 function pruneCheckLogs(storeRoot, options = {}) {
   const limits = { ...LOG_RETENTION, ...options.retention };
   const now = options.now ?? Date.now();
-  const dir = path37.join(storeRoot, "blobs", "logs");
+  const dir = path38.join(storeRoot, "blobs", "logs");
   const report = { removed: 0, removedBytes: 0, kept: 0 };
   let names;
   try {
@@ -71800,7 +72211,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   const files = names.flatMap((name) => {
     try {
-      const stat = fs18.statSync(path37.join(dir, name));
+      const stat = fs18.statSync(path38.join(dir, name));
       return stat.isFile() ? [{ name, size: stat.size, mtimeMs: stat.mtimeMs }] : [];
     } catch {
       return [];
@@ -71819,7 +72230,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
       continue;
     if (!options.dryRun)
       try {
-        fs18.rmSync(path37.join(dir, file.name), { force: true });
+        fs18.rmSync(path38.join(dir, file.name), { force: true });
       } catch {
         continue;
       }
@@ -71850,9 +72261,9 @@ var init_checks3 = __esm(() => {
 // packages/workit-cli/src/verbs/gc.ts
 var exports_gc = {};
 __export(exports_gc, {
-  run: () => run6
+  run: () => run7
 });
-async function run6(argv, io) {
+async function run7(argv, io) {
   const dryRun = argv.includes("--dry-run");
   const pruneRecovery = argv.includes("--prune-recovery");
   if (pruneRecovery && !dryRun && !argv.includes("--yes"))
@@ -71896,9 +72307,9 @@ var init_gc = __esm(() => {
 // packages/workit-cli/src/verbs/uninstall.ts
 var exports_uninstall = {};
 __export(exports_uninstall, {
-  run: () => run7
+  run: () => run8
 });
-async function run7(_argv, io) {
+async function run8(_argv, io) {
   if (io.json)
     return emit(io, fail("invalid_input", "workit uninstall is interactive and has no --json output", {
       unblock: "run `workit uninstall` in a terminal without --json"
@@ -71914,7 +72325,7 @@ var init_uninstall2 = __esm(() => {
 // packages/workit-cli/src/verbs/grant.ts
 var exports_grant = {};
 __export(exports_grant, {
-  run: () => run8,
+  run: () => run9,
   runGrant: () => runGrant
 });
 function show(argv, io) {
@@ -72035,7 +72446,7 @@ var USAGE2 = "workit grant show [<workspace>] [--all] | grant set <workspace> <k
   ...endpoint.endpointIssue ? [`  note: ${endpoint.endpointIssue}`] : [],
   `  verification: ${verification} (${verification === "independent" ? "a normal-risk behavior change needs a non-author verdict" : "a normal-risk behavior change needs a passing check and the author's --self verdict, shown as self-reviewed"})`
 ], usage2 = (io, message) => emit(io, fail("invalid_input", `${message}
-usage: ${USAGE2}`)), run8 = (argv, io) => runGrant(argv, io);
+usage: ${USAGE2}`)), run9 = (argv, io) => runGrant(argv, io);
 var init_grant = __esm(() => {
   init_autonomy();
   init_release_tracks();
@@ -72064,9 +72475,9 @@ var init_grant = __esm(() => {
 // packages/workit-cli/src/verbs/check.ts
 var exports_check = {};
 __export(exports_check, {
-  run: () => run9
+  run: () => run10
 });
-import path38 from "node:path";
+import path39 from "node:path";
 function parse5(argv) {
   const split = argv.indexOf("--");
   const head = split >= 0 ? argv.slice(0, split) : [...argv];
@@ -72215,7 +72626,7 @@ function boundedArgv(argv) {
   const truncated = cut.length !== argv.length || cut.some((item, index) => item !== argv[index]);
   return { argv: cut, truncated };
 }
-async function run9(argv, io) {
+async function run10(argv, io) {
   const options = parse5(argv);
   if (options instanceof Error)
     return emit(io, fail("invalid_input", options.message, { unblock: USAGE3 }));
@@ -72249,7 +72660,7 @@ async function run9(argv, io) {
     if (options.shell && command.length !== 1)
       return emit(io, fail("invalid_input", '--shell takes the command as one string: workit check --shell -- "<cmd>"'));
   }
-  const relCwd = posix(path38.relative(top, runCwd));
+  const relCwd = posix(path39.relative(top, runCwd));
   const configured = !options.shell && matchesNamedCheck(config, name, command, relCwd);
   const actor = actorFromEnv(io.env);
   const branchKey = codeKey(io.cwd, { base: options.base });
@@ -72373,7 +72784,7 @@ async function run9(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE3 = "workit check <name> | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--json] -- <cmd…>", RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path38.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS;
+var USAGE3 = "workit check <name> | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--json] -- <cmd…>", RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path39.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -72395,9 +72806,9 @@ var init_check = __esm(() => {
 var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
 
 // packages/workit-core/src/git/ops.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
-import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
-import path39 from "node:path";
+import { spawnSync as spawnSync18 } from "node:child_process";
+import { existsSync as existsSync19, readFileSync as readFileSync19 } from "node:fs";
+import path40 from "node:path";
 function operationInProgress(cwd) {
   const markers = [
     ["rebase-merge", "rebase"],
@@ -72410,18 +72821,18 @@ function operationInProgress(cwd) {
   if (!run.ok)
     return null;
   const found = run.stdout.split(`
-`).map((line) => path39.resolve(cwd, line.trim()));
+`).map((line) => path40.resolve(cwd, line.trim()));
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
-    if (!marker || !existsSync18(marker))
+    if (!marker || !existsSync19(marker))
       continue;
-    if (index === 1 && existsSync18(path39.join(marker, "applying")))
+    if (index === 1 && existsSync19(path40.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync18(path39.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync19(path40.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
-        headName = readFileSync18(path39.join(marker, "head-name"), "utf8").trim();
+        headName = readFileSync19(path40.join(marker, "head-name"), "utf8").trim();
       } catch {}
       const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
       return { operation, commitAllowed: branch !== null, branch };
@@ -72671,7 +73082,7 @@ function gitCommit(cwd, input) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
     const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
-    const addable = paths.filter((value) => existsSync18(path39.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    const addable = paths.filter((value) => existsSync19(path40.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
     if (addable.length) {
       const added = git5(cwd, ["add", "-A", "--", ...addable]);
       if (!added.ok)
@@ -72950,7 +73361,7 @@ ${run.stdout}`;
   } : { ok: false, lease: false, error: gitError(run) };
 }
 var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}) => {
-  const result = spawnSync17("git", args, {
+  const result = spawnSync18("git", args, {
     cwd,
     encoding: "utf8",
     env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
@@ -73004,10 +73415,10 @@ var init_ops = __esm(() => {
 
 // packages/workit-core/src/forge/reruns.ts
 import fs19 from "node:fs";
-import path40 from "node:path";
+import path41 from "node:path";
 function rerunLogPath(cwd) {
   const common = gitCommonDir(cwd);
-  return common ? path40.join(common, "workit", "ci-reruns.jsonl") : null;
+  return common ? path41.join(common, "workit", "ci-reruns.jsonl") : null;
 }
 function rerunCounts(cwd, key) {
   const counts = new Map;
@@ -73042,7 +73453,7 @@ function recordReruns(cwd, rows) {
   if (!file)
     return false;
   try {
-    fs19.mkdirSync(path40.dirname(file), { recursive: true });
+    fs19.mkdirSync(path41.dirname(file), { recursive: true });
     fs19.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
 `).join(""));
     return true;
@@ -73055,7 +73466,7 @@ function withRerunLock(cwd, fn) {
   if (!file)
     return fn();
   const lock = `${file.slice(0, -".jsonl".length)}.lock`;
-  fs19.mkdirSync(path40.dirname(lock), { recursive: true });
+  fs19.mkdirSync(path41.dirname(lock), { recursive: true });
   const until = Date.now() + LOCK_WAIT_MS2;
   for (;; ) {
     try {
@@ -73478,7 +73889,7 @@ var init_report = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-ops.ts
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
 function fillFromCommits(cwd, resolved, base) {
   const tracking = `refs/remotes/${resolved.baseRemote}/${base}`;
   if (!base.startsWith("-"))
@@ -73486,7 +73897,7 @@ function fillFromCommits(cwd, resolved, base) {
   const from = resolveRef(cwd, tracking) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return failure3("not_found", `base ${base} is not available locally`, `git fetch ${resolved.baseRemote} ${base}`);
-  const log = spawnSync18("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
+  const log = spawnSync19("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -73842,10 +74253,10 @@ var init_pr_ops = __esm(() => {
 });
 
 // packages/workit-core/src/stack.ts
-import { spawnSync as spawnSync19 } from "node:child_process";
+import { spawnSync as spawnSync20 } from "node:child_process";
 import { createHash as createHash16, randomBytes as randomBytes3 } from "node:crypto";
 import fs20 from "node:fs";
-import path41 from "node:path";
+import path42 from "node:path";
 function worktreeOf(cwd, branch) {
   const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
   if (!list.ok)
@@ -73889,7 +74300,7 @@ function gitRestack(cwd, input) {
     if (!scratch)
       return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
     fs20.mkdirSync(scratch, { recursive: true });
-    dir = path41.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
+    dir = path42.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
@@ -73930,7 +74341,7 @@ function pruneScratch(cwd) {
   if (!scratch || !fs20.existsSync(scratch))
     return;
   for (const name of fs20.readdirSync(scratch)) {
-    const dir = path41.join(scratch, name);
+    const dir = path42.join(scratch, name);
     if (!rebaseInProgress(dir) && !trackedDirt(dir))
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   }
@@ -73940,7 +74351,7 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path41.join(root.value.root, "stacks") };
+  return { ok: true, data: path42.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
   if (!isRecord7(raw) || !Array.isArray(raw.branches))
@@ -73992,7 +74403,7 @@ function readStack(cwd, name) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path41.join(dir.data, fileFor(name));
+  const file = path42.join(dir.data, fileFor(name));
   let text;
   try {
     text = fs20.readFileSync(file, "utf8");
@@ -74013,7 +74424,7 @@ function writeStack(cwd, stack, now = new Date) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path41.join(dir.data, fileFor(stack.name));
+  const file = path42.join(dir.data, fileFor(stack.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs20.mkdirSync(dir.data, { recursive: true });
@@ -74041,7 +74452,7 @@ function listStacks(cwd) {
   for (const name of names) {
     let parsed = null;
     try {
-      parsed = parseStack(JSON.parse(fs20.readFileSync(path41.join(dir.data, name), "utf8")));
+      parsed = parseStack(JSON.parse(fs20.readFileSync(path42.join(dir.data, name), "utf8")));
     } catch {
       parsed = null;
     }
@@ -74100,7 +74511,7 @@ function takeLock(lock) {
     host: localLockHost(),
     nonce: randomBytes3(8).toString("hex")
   };
-  fs20.writeFileSync(path41.join(lock, OWNER), JSON.stringify(owner));
+  fs20.writeFileSync(path42.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
@@ -74137,7 +74548,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
     return dir;
   if (!validName(name))
     return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
-  const lock = path41.join(dir.data, `${fileFor(name)}.lock`);
+  const lock = path42.join(dir.data, `${fileFor(name)}.lock`);
   try {
     fs20.mkdirSync(dir.data, { recursive: true });
   } catch (error) {
@@ -74167,7 +74578,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
   const touch = () => {
     try {
       const now = new Date;
-      fs20.utimesSync(path41.join(lock, OWNER), now, now);
+      fs20.utimesSync(path42.join(lock, OWNER), now, now);
     } catch {}
   };
   const beat = setInterval(touch, HEARTBEAT_MS);
@@ -74355,7 +74766,7 @@ function commitKeys(cwd, range) {
   const patches = new Map;
   const diff = gitRun3(cwd, ["log", "--no-merges", "-p", "--format=commit %H", range]);
   if (diff.ok && diff.stdout.trim()) {
-    const ids = spawnSync19("git", ["patch-id", "--stable"], {
+    const ids = spawnSync20("git", ["patch-id", "--stable"], {
       cwd,
       input: diff.stdout,
       encoding: "utf8",
@@ -74979,7 +75390,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
 }), fromForge = (result) => stackFail(result.code, result.error, result.unblock), stackDeps, gitRun3 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync19("git", args, {
+  const run = spawnSync20("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -75007,7 +75418,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return !status.ok || status.stdout.trim() !== "";
 }, scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path41.join(dir.data, "worktrees") : null;
+  return dir.ok ? path42.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
 `).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash16("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
@@ -75022,12 +75433,12 @@ ${run.stdout}`.split(`
 }, isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
-    raw = fs20.readFileSync(path41.join(lock, OWNER), "utf8");
+    raw = fs20.readFileSync(path42.join(lock, OWNER), "utf8");
   } catch {
     raw = null;
   }
   let age = null;
-  for (const target of [path41.join(lock, OWNER), lock])
+  for (const target of [path42.join(lock, OWNER), lock])
     try {
       age = Date.now() - fs20.statSync(target).mtimeMs;
       break;
@@ -75060,7 +75471,7 @@ var init_stack = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-edit.ts
-import { spawnSync as spawnSync20 } from "node:child_process";
+import { spawnSync as spawnSync21 } from "node:child_process";
 function openPr(cwd, resolved, pr) {
   const grant = requireGrant(cwd, "pr");
   if (!grant.allowed)
@@ -75225,7 +75636,7 @@ function replyToThread(cwd, resolved, input) {
   });
 }
 var label = (resolved, number) => `${resolved.forge.kind === "github" ? "PR #" : "MR !"}${number}`, git6 = (cwd, args) => {
-  const run = spawnSync20("git", args, {
+  const run = spawnSync21("git", args, {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -75245,15 +75656,15 @@ var init_pr_edit = __esm(() => {
 });
 
 // packages/workit-core/src/forge/exec.ts
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 import fs21 from "node:fs";
-import path42 from "node:path";
+import path43 from "node:path";
 function findExecutable(bin, env) {
-  const dirs = (env.PATH ?? env.Path ?? "").split(path42.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path43.delimiter).filter(Boolean);
   const exts = process.platform === "win32" ? [".exe"] : [""];
   for (const dir of dirs)
     for (const ext of exts) {
-      const candidate = path42.join(dir, `${bin}${ext}`);
+      const candidate = path43.join(dir, `${bin}${ext}`);
       try {
         const stat = fs21.statSync(candidate);
         if (stat.isFile())
@@ -75280,7 +75691,7 @@ function systemRunner(kind, apiHost, env = process.env) {
     if (!exe)
       return { status: null, stdout: "", stderr: "", timedOut: false, missing: true };
     const token = options.token ? kind === "github" ? { GH_TOKEN: options.token, GH_ENTERPRISE_TOKEN: options.token } : { GITLAB_TOKEN: options.token } : {};
-    const result = spawnSync21(exe, [...args], {
+    const result = spawnSync22(exe, [...args], {
       encoding: "utf8",
       env: { ...childEnv, ...token },
       maxBuffer: MAX_BUFFER2,
@@ -76444,7 +76855,7 @@ var init_duration = __esm(() => {
 });
 
 // packages/workit-cli/src/verbs/forge-common.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 function parseFlags(argv, spec) {
   const parsed = { values: {}, booleans: new Set, lists: {}, positionals: [] };
   for (let index = 0;index < argv.length; index += 1) {
@@ -76588,7 +76999,7 @@ var init_forge_common = __esm(() => {
   forgeDeps = {
     runner: undefined,
     npm: undefined,
-    readStdin: () => readFileSync19(0, "utf8"),
+    readStdin: () => readFileSync20(0, "utf8"),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     now: () => Date.now()
   };
@@ -76597,14 +77008,14 @@ var init_forge_common = __esm(() => {
 // packages/workit-cli/src/verbs/pr.ts
 var exports_pr = {};
 __export(exports_pr, {
-  run: () => run10
+  run: () => run11
 });
-import { readFileSync as readFileSync20 } from "node:fs";
-import path43 from "node:path";
+import { readFileSync as readFileSync21 } from "node:fs";
+import path44 from "node:path";
 function readBodyFile(io, file) {
   try {
     return {
-      body: file === "-" ? forgeDeps.readStdin() : readFileSync20(path43.resolve(io.cwd, file), "utf8")
+      body: file === "-" ? forgeDeps.readStdin() : readFileSync21(path44.resolve(io.cwd, file), "utf8")
     };
   } catch {
     return `cannot read --body-file ${file}`;
@@ -76931,7 +77342,7 @@ async function reply(argv, io) {
     `${[data.replied ? "replied to" : null, data.resolved ? "resolved" : null].filter(Boolean).join(" and ")} thread ${data.thread} on ${prLabel(kind, data.number)}${data.replyUrl ? `  ${data.replyUrl}` : ""}`
   ]);
 }
-async function run10(argv, io) {
+async function run11(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "status")
     return status(rest, io);
@@ -76966,7 +77377,7 @@ var init_pr = __esm(() => {
 // packages/workit-cli/src/verbs/ci.ts
 var exports_ci = {};
 __export(exports_ci, {
-  run: () => run11
+  run: () => run12
 });
 async function wait(argv, io) {
   const flags = parseFlags(argv, {
@@ -77135,7 +77546,7 @@ async function rerun(argv, io) {
     "next: workit ci wait"
   ]);
 }
-async function run11(argv, io) {
+async function run12(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "wait")
     return wait(rest, io);
@@ -77183,10 +77594,10 @@ var init_implicit_task = __esm(() => {
 // packages/workit-cli/src/verbs/git.ts
 var exports_git = {};
 __export(exports_git, {
-  run: () => run12
+  run: () => run13
 });
-import { readFileSync as readFileSync21 } from "node:fs";
-import path44 from "node:path";
+import { readFileSync as readFileSync22 } from "node:fs";
+import path45 from "node:path";
 async function branch(argv, io) {
   const flags = parseFlags(argv, {
     base: "value",
@@ -77277,7 +77688,7 @@ function commitMessage(parsed, io) {
 
 `);
   try {
-    return file === "-" ? readFileSync21(0, "utf8") : readFileSync21(path44.resolve(io.cwd, file), "utf8");
+    return file === "-" ? readFileSync22(0, "utf8") : readFileSync22(path45.resolve(io.cwd, file), "utf8");
   } catch (error) {
     return {
       error: `cannot read -F ${file}: ${error instanceof Error ? error.message : String(error)}`
@@ -77380,7 +77791,7 @@ async function push(argv, io) {
     ...data.upstream ? [`upstream: ${data.remote}/${data.branch}`] : []
   ]);
 }
-async function run12(argv, io) {
+async function run13(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "branch")
     return branch(rest, io);
@@ -77408,7 +77819,7 @@ var init_git2 = __esm(() => {
 });
 
 // packages/workit-core/src/forge/verify.ts
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 function finish(cwd, report, actor) {
   const delivered = report.observations.length > 0 && report.observations.every((entry) => entry.ok);
   const out = { ...report, delivered };
@@ -77621,7 +78032,7 @@ var NPM_NAME, SEMVER2, SAFE_ARG, systemNpm = (args) => {
   };
   const found = process.platform === "win32" ? findExecutable("npm.cmd", process.env) : null;
   const npmCmd = found && !/["%!^]/u.test(found) ? `"${found}"` : "npm.cmd";
-  const result = process.platform === "win32" ? spawnSync22(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync22("npm", [...args], options);
+  const result = process.platform === "win32" ? spawnSync23(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync23("npm", [...args], options);
   return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
 }, short3 = (sha) => sha ? sha.slice(0, 12) : "(absent)", npmView = (stdout) => {
   try {
@@ -77646,9 +78057,9 @@ var init_verify = __esm(() => {
 // packages/workit-cli/src/verbs/verify-delivery.ts
 var exports_verify_delivery = {};
 __export(exports_verify_delivery, {
-  run: () => run13
+  run: () => run14
 });
-async function run13(argv, io) {
+async function run14(argv, io) {
   const flags = parseFlags(argv, {
     expect: "value",
     branch: "value",
@@ -77730,7 +78141,7 @@ var init_verify_delivery = __esm(() => {
 // packages/workit-cli/src/verbs/stack.ts
 var exports_stack = {};
 __export(exports_stack, {
-  run: () => run14
+  run: () => run15
 });
 async function plan(argv, io) {
   const flags = parseFlags(argv, { name: "value", trunk: "value", track: "value" });
@@ -77912,7 +78323,7 @@ async function land(argv, io) {
   unblock: ${data.stoppedAt.unblock}` : data.complete ? "stack complete" : ""
   ].filter(Boolean));
 }
-async function run14(argv, io) {
+async function run15(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub === "plan")
     return plan(rest, io);
@@ -77942,10 +78353,10 @@ var init_stack2 = __esm(() => {
 });
 
 // packages/workit-core/src/fanout.ts
-import { spawnSync as spawnSync23 } from "node:child_process";
+import { spawnSync as spawnSync24 } from "node:child_process";
 import { createHash as createHash17 } from "node:crypto";
 import fs23 from "node:fs";
-import path45 from "node:path";
+import path46 from "node:path";
 function expandBraces(pattern, limit = 64) {
   for (let index = 0;index < pattern.length; index += 1) {
     if (pattern[index] === "\\") {
@@ -78179,7 +78590,7 @@ function parsePlan(raw, defaults, name) {
       id,
       branch,
       base: optional("base") ?? "",
-      worktree: path45.resolve(defaults.root, optional("worktree") ?? path45.join(defaults.worktreeRoot, id)),
+      worktree: path46.resolve(defaults.root, optional("worktree") ?? path46.join(defaults.worktreeRoot, id)),
       tier,
       dependsOn: [...new Set(dependsOn ?? [])],
       scope,
@@ -78408,11 +78819,11 @@ function defaultTrunk(cwd) {
 }
 function mainCheckout(cwd) {
   const common = gitCommonDir(cwd);
-  return common && path45.basename(common) === ".git" ? path45.dirname(common) : path45.resolve(cwd);
+  return common && path46.basename(common) === ".git" ? path46.dirname(common) : path46.resolve(cwd);
 }
 function worktreeRoot(cwd) {
   const main = mainCheckout(cwd);
-  return path45.join(path45.dirname(main), `${path45.basename(main)}-wt`);
+  return path46.join(path46.dirname(main), `${path46.basename(main)}-wt`);
 }
 function sliceHash(slice) {
   const {
@@ -78430,7 +78841,7 @@ function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path45.join(root.value.root, "fanouts") };
+  return { ok: true, data: path46.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
   if (!isRecord8(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
@@ -78496,7 +78907,7 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path45.join(dir.data, stackFileName(name));
+  const file = path46.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
     parsed = parseStored(JSON.parse(fs23.readFileSync(file, "utf8")));
@@ -78521,7 +78932,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs23.readFileSync(path45.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs23.readFileSync(path46.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -78551,7 +78962,7 @@ function writeFanout(cwd, plan) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path45.join(dir.data, stackFileName(plan.name));
+  const file = path46.join(dir.data, stackFileName(plan.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs23.mkdirSync(dir.data, { recursive: true });
@@ -78715,7 +79126,7 @@ var FANOUT_VERSION = 1, TIERS, FAN_IN_MODES, fanoutFail = (code, error, unblock,
     text: edges.map((edge) => `add "${edge.dependsOn}" to "dependsOn" of slice ${edge.slice}`).join("; ")
   };
 }, gitRun4 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync23("git", args, {
+  const run = spawnSync24("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -78755,7 +79166,7 @@ var init_fanout = __esm(() => {
 // packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import fs24 from "node:fs";
-import path46 from "node:path";
+import path47 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -78815,7 +79226,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs24.readFileSync(path46.join(file, TOKEN_FILE), "utf8").trim() || null;
+    token = fs24.readFileSync(path47.join(file, TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -78823,7 +79234,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path46.basename(file),
+      id: path47.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -78839,7 +79250,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes4(16).toString("hex");
   try {
-    fs24.writeFileSync(path46.join(admin.path, TOKEN_FILE), `${token}
+    fs24.writeFileSync(path47.join(admin.path, TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -78854,7 +79265,7 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path46.join(common, "info", "exclude");
+  const file = path47.join(common, "info", "exclude");
   let text = "";
   try {
     text = fs24.readFileSync(file, "utf8");
@@ -78863,7 +79274,7 @@ function excludeScratch(cwd) {
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs24.mkdirSync(path46.dirname(file), { recursive: true });
+  fs24.mkdirSync(path47.dirname(file), { recursive: true });
   fs24.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
@@ -78871,7 +79282,7 @@ ${EXCLUDE_LINE}
 `);
 }
 function ensureScratch(worktree) {
-  const scratch = path46.join(worktree, SCRATCH_DIR);
+  const scratch = path47.join(worktree, SCRATCH_DIR);
   fs24.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
@@ -79007,7 +79418,7 @@ function releaseSliceWorktree(cwd, plan, input) {
   const entry = worktrees[index];
   if (index === 0)
     return fanoutFail("blocked", `${target} is the main checkout; it is never released`);
-  if (inside2(cwd, entry.path))
+  if (inside3(cwd, entry.path))
     return fanoutFail("blocked", `this command runs inside ${entry.path}`, `run it from the main checkout: workit --cwd <main checkout> fanout worktree release ${slice.id}`);
   if (entry.branch !== null && entry.branch !== `refs/heads/${slice.branch}`)
     return fanoutFail("blocked", `${entry.path} is on ${entry.branch.replace(/^refs\/heads\//u, "")}, not slice ${slice.id}'s ${slice.branch}; nothing was removed`);
@@ -79089,7 +79500,7 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path46.join(worktree, SCRATCH_DIR);
+  const scratch = path47.join(worktree, SCRATCH_DIR);
   let stat;
   try {
     stat = fs24.lstatSync(scratch);
@@ -79105,16 +79516,16 @@ var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000,
   try {
     return fs24.realpathSync.native(target);
   } catch {
-    return path46.resolve(target);
+    return path47.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
-}, inside2 = (child, parent) => {
-  const relative = path46.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path46.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path46.isAbsolute(slice.worktree) ? slice.worktree : path46.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
+}, inside3 = (child, parent) => {
+  const relative = path47.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path47.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path47.isAbsolute(slice.worktree) ? slice.worktree : path47.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
 `)[0] || "unknown error"}`);
 var init_fanout_worktree = __esm(() => {
   init_ops();
@@ -79235,7 +79646,7 @@ var init_fanout_brief = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-landed.ts
-import { spawnSync as spawnSync24 } from "node:child_process";
+import { spawnSync as spawnSync25 } from "node:child_process";
 function forgeBreaker(resolved) {
   if (!resolved)
     return { forge: null, down: () => null };
@@ -79326,7 +79737,7 @@ function trunkPatchIds(ctx, fork) {
     "--"
   ]);
   if (log.ok && log.stdout.trim()) {
-    const run = spawnSync24("git", ["patch-id", "--stable"], {
+    const run = spawnSync25("git", ["patch-id", "--stable"], {
       cwd: ctx.cwd,
       input: log.stdout,
       encoding: "utf8",
@@ -79887,10 +80298,10 @@ var init_fanout_status = __esm(() => {
 // packages/workit-cli/src/verbs/fanout.ts
 var exports_fanout = {};
 __export(exports_fanout, {
-  run: () => run15
+  run: () => run16
 });
 import fs25 from "node:fs";
-import path47 from "node:path";
+import path48 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -79951,7 +80362,7 @@ function plan2(argv, io) {
     return usage3(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage3(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path47.resolve(io.cwd, flags.positionals[0]);
+  const file = path48.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
     raw = JSON.parse(fs25.readFileSync(file, "utf8"));
@@ -80107,7 +80518,7 @@ function worktree(argv, io) {
     ...data.notes.map((note) => `note: ${note}`)
   ]);
 }
-async function run15(argv, io) {
+async function run16(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub === "plan")
     return plan2(rest, io);
@@ -80173,7 +80584,7 @@ var init_fanout2 = __esm(() => {
 // packages/workit-cli/src/verbs/ledger.ts
 var exports_ledger = {};
 __export(exports_ledger, {
-  run: () => run16
+  run: () => run17
 });
 import { randomBytes as randomBytes5 } from "node:crypto";
 import { parseArgs } from "node:util";
@@ -80197,7 +80608,7 @@ function targetBranch(io, rows, branch, pr) {
   }
   return { ok: true, value: branch ?? null };
 }
-async function run16(argv, io) {
+async function run17(argv, io) {
   let parsed;
   try {
     parsed = parseArgs({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
@@ -95434,7 +95845,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path48 from "node:path";
+import path49 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -95927,12 +96338,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path48.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path49.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path48.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path49.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -96320,11 +96731,11 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/audit.ts
-import { spawnSync as spawnSync25 } from "node:child_process";
-import { existsSync as existsSync19, readdirSync as readdirSync9, readFileSync as readFileSync22, statSync as statSync7 } from "node:fs";
-import path49 from "node:path";
+import { spawnSync as spawnSync26 } from "node:child_process";
+import { existsSync as existsSync20, readdirSync as readdirSync9, readFileSync as readFileSync23, statSync as statSync8 } from "node:fs";
+import path50 from "node:path";
 function git7(cwd, args) {
-  const run = spawnSync25("git", ["-c", "core.quotepath=off", ...args], {
+  const run = spawnSync26("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -96335,7 +96746,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync9(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path49.join(dir, entry.name);
+    const full = path50.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -96347,10 +96758,10 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path49.resolve(cwd, input);
-    if (!existsSync19(full))
+    const full = path50.resolve(cwd, input);
+    if (!existsSync20(full))
       missing.push(input);
-    else if (statSync7(full).isDirectory())
+    else if (statSync8(full).isDirectory())
       walkTests(full, files);
     else
       files.push(full);
@@ -96384,11 +96795,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path49.join(root, file), lines);
+    changed.set(path50.join(root, file), lines);
   }
   const untracked = git7(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path49.join(root, file), "all");
+    changed.set(path50.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -96401,7 +96812,7 @@ function auditFiles(files, display) {
     const shown = display(file);
     let parsed;
     try {
-      parsed = parseSource(readFileSync22(file, "utf8"), file);
+      parsed = parseSource(readFileSync23(file, "utf8"), file);
     } catch (error) {
       parseErrors.push({
         file: shown,
@@ -96450,7 +96861,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path49.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path50.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -96464,23 +96875,23 @@ var init_audit = __esm(() => {
 // packages/workit-cli/src/test-audit/mutate.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  existsSync as existsSync20,
-  lstatSync as lstatSync7,
-  mkdirSync as mkdirSync9,
+  existsSync as existsSync21,
+  lstatSync as lstatSync8,
+  mkdirSync as mkdirSync10,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync10,
-  readFileSync as readFileSync23,
+  readFileSync as readFileSync24,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync9,
-  renameSync as renameSync5,
-  rmSync as rmSync7,
-  statSync as statSync8,
+  renameSync as renameSync6,
+  rmSync as rmSync8,
+  statSync as statSync9,
   symlinkSync,
-  writeFileSync as writeFileSync10,
+  writeFileSync as writeFileSync11,
   copyFileSync as copyFileSync6
 } from "node:fs";
 import os14 from "node:os";
-import path50 from "node:path";
+import path51 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -96553,7 +96964,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path50.posix.join(path50.posix.dirname(file), spec)) === target)
+        if (stripExt(path51.posix.join(path51.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -96573,12 +96984,12 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path50.join(tmp, name);
+    const dir = path51.join(tmp, name);
     try {
-      const stat = lstatSync7(dir);
+      const stat = lstatSync8(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync23(path50.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync24(path51.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -96586,23 +96997,23 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
         continue;
     }
     try {
-      rmSync7(dir, { recursive: true, force: true });
+      rmSync8(dir, { recursive: true, force: true });
       removed += 1;
     } catch {}
   }
   return removed;
 }
 function linkNodeModules(origin, target, repo, copy) {
-  mkdirSync9(target, { recursive: true });
+  mkdirSync10(target, { recursive: true });
   for (const entry of readdirSync10(origin, { withFileTypes: true })) {
-    const from = path50.join(origin, entry.name);
-    const to = path50.join(target, entry.name);
+    const from = path51.join(origin, entry.name);
+    const to = path51.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
     }
     if (entry.name.startsWith(".") && entry.name !== ".bin" && entry.isDirectory()) {
-      mkdirSync9(to, { recursive: true });
+      mkdirSync10(to, { recursive: true });
       continue;
     }
     if (entry.isSymbolicLink()) {
@@ -96612,9 +97023,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path50.relative(repo, real);
-      if (!relative.startsWith("..") && !path50.isAbsolute(relative) && !relative.split(path50.sep).includes("node_modules")) {
-        symlinkSync(path50.join(copy, relative), to, "junction");
+      const relative = path51.relative(repo, real);
+      if (!relative.startsWith("..") && !path51.isAbsolute(relative) && !relative.split(path51.sep).includes("node_modules")) {
+        symlinkSync(path51.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -96629,33 +97040,33 @@ function copySymlink(repo, tree, from, to) {
     real = null;
   }
   const realRepo = realpathSync9(repo);
-  if (real && inside3(realRepo, real)) {
-    symlinkSync(path50.relative(path50.dirname(to), path50.join(tree, path50.relative(realRepo, real))), to);
+  if (real && inside4(realRepo, real)) {
+    symlinkSync(path51.relative(path51.dirname(to), path51.join(tree, path51.relative(realRepo, real))), to);
     return;
   }
-  if (real && statSync8(real).isFile())
+  if (real && statSync9(real).isFile())
     copyFileSync6(real, to);
   else
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path50.join(copy, file);
+  const target = path51.join(copy, file);
   try {
-    const stat = lstatSync7(target);
-    if (!stat.isFile() || !inside3(realpathSync9(copy), realpathSync9(path50.dirname(target))))
+    const stat = lstatSync8(target);
+    if (!stat.isFile() || !inside4(realpathSync9(copy), realpathSync9(path51.dirname(target))))
       return false;
   } catch {
     return false;
   }
   const temp = `${target}.workit-mutant-${process.pid}`;
-  writeFileSync10(temp, content);
-  renameSync5(temp, target);
+  writeFileSync11(temp, content);
+  renameSync6(temp, target);
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path50.join(os14.tmpdir(), TEMP_PREFIX));
-  writeFileSync10(path50.join(dir, PID_FILE), String(process.pid));
-  const tree = path50.join(dir, "tree");
+  const dir = mkdtempSync4(path51.join(os14.tmpdir(), TEMP_PREFIX));
+  writeFileSync11(path51.join(dir, PID_FILE), String(process.pid));
+  const tree = path51.join(dir, "tree");
   const head = git7(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git7(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git7(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -96666,35 +97077,35 @@ function copyWorkingTree(repo) {
       git7(tree, ["update-ref", "--no-deref", "HEAD", head]);
     git7(tree, ["reset", "-q"]);
   } else
-    mkdirSync9(tree, { recursive: true });
+    mkdirSync10(tree, { recursive: true });
   const listed = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00");
   const dirs = new Set([""]);
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path50.join(repo, relative);
+    const from = path51.join(repo, relative);
     let stat;
     try {
-      stat = lstatSync7(from);
+      stat = lstatSync8(from);
     } catch {
       continue;
     }
-    const to = path50.join(tree, relative);
-    mkdirSync9(path50.dirname(to), { recursive: true });
+    const to = path51.join(tree, relative);
+    mkdirSync10(path51.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync6(from, to);
-    let parent = path50.dirname(relative);
+    let parent = path51.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path50.dirname(parent);
+      parent = path51.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path50.join(repo, parent, "node_modules");
-    if (existsSync20(modules) && !existsSync20(path50.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path50.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path51.join(repo, parent, "node_modules");
+    if (existsSync21(modules) && !existsSync21(path51.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path51.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -96733,20 +97144,20 @@ async function runMutation(options) {
   const tracked = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync23(path50.join(repo, file), "utf8") };
+      return { file, text: readFileSync24(path51.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path50.relative(repo, absolute));
+    const relative = toPosix(path51.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
-    if (NOT_SOURCE.test(relative) || !existsSync20(absolute))
+    if (NOT_SOURCE.test(relative) || !existsSync21(absolute))
       continue;
     try {
-      candidates.push(...mutantsFor(readFileSync23(absolute, "utf8"), relative, lines));
+      candidates.push(...mutantsFor(readFileSync24(absolute, "utf8"), relative, lines));
     } catch {}
   }
   const mutants = candidates.map((mutant, index) => ({ ...mutant, id: index + 1 }));
@@ -96754,9 +97165,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path50.relative(repo, options.cwd);
+  const cwdRelative = path51.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path50.relative(cwdRelative, file));
+    const relative = toPosix(path51.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -96791,7 +97202,7 @@ async function runMutation(options) {
     return finish2(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path50.join(copy, cwdRelative);
+  const copyCwd = path51.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -96802,7 +97213,7 @@ async function runMutation(options) {
     for (const child of active)
       killTree(child);
     restore();
-    rmSync7(copyDir, { recursive: true, force: true });
+    rmSync8(copyDir, { recursive: true, force: true });
   };
   const onSignal = (signal) => {
     cleanup();
@@ -96826,7 +97237,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync23(path50.join(copy, mutant.file), "utf8");
+      const original = readFileSync24(path51.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -96882,9 +97293,9 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
   } catch (error) {
     return error.code === "EPERM";
   }
-}, inside3 = (root, file) => {
-  const relative = path50.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path50.isAbsolute(relative);
+}, inside4 = (root, file) => {
+  const relative = path51.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path51.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -96930,10 +97341,10 @@ var init_mutate = __esm(() => {
 // packages/workit-cli/src/verbs/test-audit.ts
 var exports_test_audit = {};
 __export(exports_test_audit, {
-  run: () => run17
+  run: () => run18
 });
-import { existsSync as existsSync21 } from "node:fs";
-import path51 from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import path52 from "node:path";
 function parse7(argv) {
   const options = {
     paths: [],
@@ -97031,14 +97442,14 @@ function human(data) {
   }
   return lines;
 }
-async function run17(argv, io) {
+async function run18(argv, io) {
   const options = parse7(argv);
   if (typeof options === "string")
     return emit(io, fail("invalid_input", `${options}
 usage: ${USAGE10}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path51.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path51.relative(io.cwd, file) || file);
+  const repo = top.ok ? path52.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path52.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -97055,7 +97466,7 @@ usage: ${USAGE10}`));
   }
   let files;
   if (options.diff && changed)
-    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync21(file)).toSorted();
+    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync22(file)).toSorted();
   else {
     const expanded = expandPaths(io.cwd, options.paths);
     if (expanded.missing.length > 0)
@@ -97142,9 +97553,9 @@ var init_test_audit = __esm(() => {
 // packages/workit-cli/src/verbs/knowledge.ts
 var exports_knowledge = {};
 __export(exports_knowledge, {
-  run: () => run18
+  run: () => run19
 });
-async function run18(argv, io) {
+async function run19(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub !== "lint" || rest.length > 0)
     return emit(io, fail("invalid_input", `usage: ${USAGE11}`));
@@ -97278,11 +97689,11 @@ var init_youtrack_writes = __esm(() => {
 // packages/workit-cli/src/verbs/youtrack.ts
 var exports_youtrack = {};
 __export(exports_youtrack, {
-  run: () => run19
+  run: () => run20
 });
-import { readFileSync as readFileSync24 } from "node:fs";
-import path52 from "node:path";
-async function run19(argv, io) {
+import { readFileSync as readFileSync25 } from "node:fs";
+import path53 from "node:path";
+async function run20(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
     return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE12);
@@ -97327,7 +97738,7 @@ async function run19(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync24(path52.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync25(path53.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE12);
       }
@@ -97393,11 +97804,11 @@ var init_youtrack2 = __esm(() => {
 // packages/workit-cli/src/verbs/changelog.ts
 var exports_changelog = {};
 __export(exports_changelog, {
-  run: () => run20
+  run: () => run21
 });
-import { readFileSync as readFileSync25 } from "node:fs";
-import path53 from "node:path";
-async function run20(argv, io) {
+import { readFileSync as readFileSync26 } from "node:fs";
+import path54 from "node:path";
+async function run21(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
     return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE13);
@@ -97442,7 +97853,7 @@ async function run20(argv, io) {
   ]);
 }
 var USAGE13 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync25(0, "utf8") : raw.startsWith("@") ? readFileSync25(path53.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync26(0, "utf8") : raw.startsWith("@") ? readFileSync26(path54.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -97454,7 +97865,7 @@ var init_changelog2 = __esm(() => {
 // packages/workit-cli/src/verbs/handoff.ts
 var exports_handoff = {};
 __export(exports_handoff, {
-  run: () => run21
+  run: () => run22
 });
 import { parseArgs as parseArgs2 } from "node:util";
 function human2(brief) {
@@ -97524,7 +97935,7 @@ async function resumeBrief(argv, io) {
   }
   return emit(io, ok({ ...data, recorded }), human2);
 }
-async function run21(argv, io) {
+async function run22(argv, io) {
   if (!argv.some((arg) => arg === "--task" || arg.startsWith("--task=")))
     return resumeBrief(argv, io);
   await Promise.resolve().then(() => init_task());
@@ -97538,7 +97949,7 @@ var init_handoff = __esm(() => {
 
 // packages/workit-cli/src/main.ts
 init_package();
-import path54 from "node:path";
+import path55 from "node:path";
 
 // packages/workit-cli/src/help.ts
 var HELP_FLAGS = new Set(["--help", "-h"]);
@@ -97757,8 +98168,8 @@ var VERBS = [
   {
     name: "doctor",
     group: "setup",
-    usage: "workit doctor [--fix-lock [--force [--yes]]]",
-    summary: "Verify the offline installation health (--fix-lock clears a stale workit store lock)",
+    usage: "workit doctor [--fix] [--fix-lock [--force [--yes]]]",
+    summary: "Verify the offline installation health (--fix installs the session trailer hook; --fix-lock clears a stale workit store lock)",
     load: () => Promise.resolve().then(() => (init_doctor2(), exports_doctor))
   },
   {
@@ -98184,7 +98595,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path54.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path55.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail("invalid_input", parsed.error));