@brainervirus/workit-codex 1.2.0 → 1.3.0

package/dist/launch-mcp.js

@@ -6621,13 +6621,13 @@ var require_dist = __commonJS(function(exports, module) {
 });
 
 // packages/workit-codex/scripts/launch-mcp.ts
-import { existsSync as existsSync8, realpathSync as realpathSync8, statSync as statSync2 } from "node:fs";
-import path15 from "node:path";
+import { existsSync as existsSync8, realpathSync as realpathSync9, statSync as statSync3 } from "node:fs";
+import path16 from "node:path";
 
 // packages/workit-core/src/core.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync5, realpathSync as realpathSync6 } from "node:fs";
-import path10 from "node:path";
+import { existsSync as existsSync5, realpathSync as realpathSync7 } from "node:fs";
+import path11 from "node:path";
 
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -11934,6 +11934,17 @@ function _array(Class, element, params) {
     ...normalizeParams(params)
   });
 }
+function _custom(Class, fn, _params) {
+  const norm = normalizeParams(_params);
+  norm.abort ?? (norm.abort = true);
+  const schema = new Class({
+    type: "custom",
+    check: "custom",
+    fn,
+    ...norm
+  });
+  return schema;
+}
 function _refine(Class, fn, _params) {
   const schema = new Class({
     type: "custom",
@@ -14087,6 +14098,9 @@ var ZodCustom = /* @__PURE__ */ $constructor("ZodCustom", (inst, def) => {
   ZodType.init(inst, def);
   inst._zod.processJSONSchema = (ctx, json, params) => customProcessor(inst, ctx, json, params);
 });
+function custom(fn, _params) {
+  return _custom(ZodCustom, fn ?? (() => true), _params);
+}
 function refine(fn, _params = {}) {
   return _refine(ZodCustom, fn, _params);
 }
@@ -14520,7 +14534,8 @@ var decisionSchema = object({
   consumption: object({
     state: _enum(["reserved", "consumed", "uncertain"]),
     at: utc,
-    actionRef: refSchema
+    actionRef: refSchema,
+    historicalActionId: text.optional()
   }).strict().nullable()
 }).strict();
 var findingSchema = object({
@@ -14551,6 +14566,7 @@ var workerSchema = object({
   assignment: assignmentSchema,
   state: _enum(["assigned", "dispatching", "running", "cancelling", "stopped", "unknown"]),
   session: refSchema.nullable(),
+  coordinator: refSchema.optional(),
   report: workerReportSchema.nullable()
 }).strict();
 var ownerSchema = object({
@@ -14662,6 +14678,7 @@ var taskSummarySchema = object({
   requirements: array(requirementEvaluationSchema),
   writer: workspaceRecordSchema.shape.writer
 }).strict();
+var taskListItemSchema = taskSummarySchema.omit({ policy: true, requirements: true }).extend({ source: provenanceSchema.pick({ host: true, kind: true }) }).strict();
 var exportBundleSchema = object({
   schemaVersion: literal(1),
   exportedAt: utc,
@@ -14683,11 +14700,16 @@ var taskOperations = {
     expectedWorkspaceRevision: revision.nullable().optional(),
     intent: intentSchema
   }),
-  list: operation({ action: literal("list") }),
+  list: operation({
+    action: literal("list"),
+    status: _enum(["open", "closed", "all"]).optional(),
+    query: string2().trim().min(1).max(200).optional(),
+    limit: number2().int().min(1).max(50).optional()
+  }),
   inspect: operation({
     action: literal("inspect"),
     ...taskId,
-    view: _enum(["summary", "full"])
+    view: _enum(["summary", "full"]).optional()
   }),
   revise: operation({
     action: literal("revise"),
@@ -14715,7 +14737,7 @@ var taskOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    authorityRefs: array(refSchema)
+    authorityRefs: array(refSchema).optional()
   }),
   close: operation({
     action: literal("close"),
@@ -15029,6 +15051,7 @@ function requirementId(input) {
 }
 // packages/workit-core/src/core/task-store.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as fs4 from "node:fs";
 import { hostname } from "node:os";
 import path4 from "node:path";
@@ -15664,7 +15687,8 @@ var metadataLockSchema = object({
   pid: number2().int().nonnegative().safe(),
   processStart: string2().nullable(),
   host: string2().min(1),
-  nonce: string2().min(1)
+  nonce: string2().min(1),
+  externalAction: literal(true).optional()
 }).strict();
 var now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
 var cachedRuntimeVersion = null;
@@ -15716,6 +15740,28 @@ var sameMetadataLock = (left, right) => {
   const parsed = metadataLockSchema.safeParse(left);
   return parsed.success && canonicalJson(parsed.data) === canonicalJson(right);
 };
+var sameDirectoryIdentity = (left, right) => {
+  if (!path4.isAbsolute(left) || !path4.isAbsolute(right))
+    return false;
+  const normalizedLeft = path4.resolve(left);
+  const normalizedRight = path4.resolve(right);
+  try {
+    const a = fs4.statSync(normalizedLeft, { bigint: true });
+    const b = fs4.statSync(normalizedRight, { bigint: true });
+    if (!a.isDirectory() || !b.isDirectory())
+      return false;
+    if (process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight)
+      return true;
+    const canonicalLeft = fs4.realpathSync(normalizedLeft);
+    const canonicalRight = fs4.realpathSync(normalizedRight);
+    if (process.platform === "win32" ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase() : canonicalLeft === canonicalRight)
+      return true;
+    return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
+  } catch {
+    return false;
+  }
+};
+var externalActionLockRoots = new AsyncLocalStorage;
 
 class TaskStore {
   root;
@@ -15776,7 +15822,7 @@ class TaskStore {
     const item = this.readRecord(this.workspacePath, workspaceRecordSchema);
     if (!item.exists)
       return success(null, null, null);
-    if (item.result.ok && item.result.data.root !== this.root)
+    if (item.result.ok && item.result.data.root !== this.root && !sameDirectoryIdentity(item.result.data.root, this.root))
       return failure("recovery_required", "workspace root binding is invalid", {
         path: this.workspacePath
       });
@@ -15867,6 +15913,29 @@ class TaskStore {
       const current = this.readWorkspace();
       if (!current.ok)
         return current;
+      const origin = input.task.origin;
+      if (current.data && origin) {
+        if (origin.workspaceId === current.data.id) {
+          const source = this.readTask(origin.taskId);
+          if (source.ok)
+            return success(source.data.revision, current.data.revision, source.data);
+          if (source.code !== "not_found")
+            return source;
+          return failure("not_found", "source task is not present in this shared workspace");
+        }
+        const tasks = this.listTasks();
+        if (!tasks.ok)
+          return tasks;
+        const prior = tasks.data.filter((task) => task.origin?.workspaceId === origin.workspaceId && task.origin?.taskId === origin.taskId);
+        if (prior.length > 1)
+          return failure("recovery_required", `source task has multiple imported mappings: ${prior.map((task) => task.id).join(", ")}`);
+        if (prior.length === 1) {
+          const existing = prior[0];
+          if (existing.origin.exportDigest !== origin.exportDigest)
+            return failure("revision_conflict", "source task export changed; reconcile the mapped destination task before importing", { taskId: existing.id });
+          return success(existing.revision, current.data.revision, existing);
+        }
+      }
       if (current.data ? input.expectedWorkspaceRevision !== current.data.revision : input.expectedWorkspaceRevision !== null)
         return failure("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", {
           expectedWorkspaceRevision: input.expectedWorkspaceRevision,
@@ -16255,6 +16324,73 @@ class TaskStore {
       })
     };
   }
+  externalActionLockOptions() {
+    const options = this.metadataLockOptions();
+    return { ...options, payload: () => ({ ...options.payload(), externalAction: true }) };
+  }
+  async withExternalActionLock(operation, reentrant = false) {
+    const activeRoots = externalActionLockRoots.getStore();
+    if (activeRoots && [...activeRoots].some((root) => root === this.root || sameDirectoryIdentity(root, this.root)))
+      return operation();
+    try {
+      this.initializeMutationStorage();
+    } catch (error) {
+      return failure("storage_error", `unable to initialize store: ${String(error)}`, {
+        path: this.workitDir
+      });
+    }
+    let handle;
+    try {
+      handle = acquireFileLockSync(this.workspacePath, this.externalActionLockOptions());
+    } catch (error) {
+      return this.lockFailure(error);
+    }
+    let result;
+    try {
+      if (!handle.verifyStillHeld())
+        result = failure("recovery_required", "metadata lock was compromised", {
+          path: this.lockPath
+        });
+      else {
+        try {
+          const run = () => operation();
+          result = await (reentrant ? externalActionLockRoots.run(new Set([...activeRoots ?? [], this.root]), run) : run());
+        } catch {
+          result = failure("external_outcome_unknown", "external action outcome is unknown", {
+            outcome: "unknown"
+          });
+        }
+        try {
+          if (!handle.verifyStillHeld())
+            result = failure("external_outcome_unknown", "metadata lock was compromised", {
+              outcome: "unknown",
+              path: this.lockPath
+            });
+        } catch {
+          result = failure("external_outcome_unknown", "metadata lock could not be verified", {
+            outcome: "unknown",
+            path: this.lockPath
+          });
+        }
+      }
+    } catch {
+      result = failure("external_outcome_unknown", "external action lock operation failed", {
+        outcome: "unknown",
+        path: this.lockPath
+      });
+    }
+    try {
+      handle.release();
+    } catch (error) {
+      const released = this.lockFailure(error);
+      const releaseError = released.ok ? "metadata lock release failed" : released.error;
+      return result.ok ? failure("external_outcome_unknown", "external action metadata lock release is uncertain", {
+        outcome: "unknown",
+        path: this.lockPath
+      }) : failure("recovery_required", `${result.error}; ${releaseError}`, result.details);
+    }
+    return result;
+  }
   recoveryLockOptions(observed, evidence, gate) {
     const options = this.metadataLockOptions();
     options.staleRecovery = "remove-if-unchanged";
@@ -16324,6 +16460,14 @@ class TaskStore {
   lockFailure(error) {
     const value = error;
     const code = typeof value?.code === "string" ? value.code : "";
+    if (code === "EEXIST" || code === "file_lock_timeout") {
+      const lock = this.readLockSnapshot();
+      if (lock.ok && lock.data?.data.externalAction)
+        return failure("writer_conflict", "workspace is reserved by a managed external action", {
+          outcome: "not_started",
+          path: this.lockPath
+        });
+    }
     const recovery = code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || code === "metadata_lock_invalid" || code === "not-file" || /metadata lock|file lock|reclaim/i.test(String(value?.message ?? error));
     return failure(recovery ? "recovery_required" : "storage_error", `metadata lock operation failed: ${String(error)}`, { path: this.lockPath });
   }
@@ -16548,6 +16692,10 @@ var validPath = (value) => typeof value === "string" && value.length > 0 && ![..
 }) && !value.split(/[\\/]/).includes("..");
 var callerValue = (value) => ({ host: value.host, actor: value.actor });
 var workerIdOf = (value) => value.workerId ?? null;
+var currentWriterOwnsTask = (task, workspace, caller) => {
+  const owner = workspace.writer?.owner;
+  return task.status === "active" && task.workspaceId === workspace.id && owner?.taskId === task.id && owner.session.host === caller.host && owner.session.handle === caller.actor;
+};
 function assertProductWriteAllowed(input) {
   if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
     return failure("invalid_input", "invalid product write path");
@@ -16587,21 +16735,23 @@ function assertProductWriteAllowed(input) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import * as fs7 from "node:fs";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import path9 from "node:path";
+import path10 from "node:path";
 
 // packages/workit-core/src/core/authority.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import * as fs6 from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // packages/workit-core/src/core/auto-approval.ts
-import { createHash as createHash3 } from "node:crypto";
-import { readFileSync as readFileSync4 } from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
+import { readFileSync as readFileSync4, realpathSync as realpathSync3 } from "node:fs";
+import path8 from "node:path";
 
 // packages/workit-core/src/core/workspaces.ts
+import { createHash as createHash3 } from "node:crypto";
 import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
 import path6 from "node:path";
 
@@ -16619,7 +16769,7 @@ import os from "node:os";
 import path5 from "node:path";
 
 // packages/workit-core/src/core/boundary.ts
-import { statSync } from "node:fs";
+import { statSync as statSync2 } from "node:fs";
 var EVENT = {
   initialization: "initialization",
   provenance: "provenance",
@@ -16647,7 +16797,7 @@ var changedSourcesSinceLoad = (marker) => {
   const changed = [];
   for (const file of marker.files) {
     try {
-      if (statSync(file).mtimeMs > marker.loadedAt)
+      if (statSync2(file).mtimeMs > marker.loadedAt)
         changed.push(file);
     } catch {}
   }
@@ -16806,33 +16956,197 @@ var COMMIT_PRESETS = [
   "custom",
   "auto"
 ];
+var resolveCommitPolicy = (config, workspace) => {
+  const wp = workspace?.commitPolicy ?? {};
+  if (COMMIT_PRESETS.includes(String(wp.preset ?? ""))) {
+    return {
+      preset: wp.preset,
+      ...typeof wp.pattern === "string" ? { pattern: wp.pattern } : {}
+    };
+  }
+  return config.commitPolicy ?? { preset: "conventional" };
+};
 
 // packages/workit-core/src/core/workspaces.ts
+var nonBlank = string2().refine((value) => value.trim().length > 0, "must not be blank");
+var branchPreset = custom((value) => typeof value === "string" && Object.hasOwn(PRESETS, value), "unsupported branch preset");
+var commitPreset = custom((value) => typeof value === "string" && COMMIT_PRESETS.includes(value), "unsupported commit preset");
+var workspaceBranchPolicySchema = object({
+  preset: branchPreset,
+  developBranch: nonBlank.optional(),
+  prefixes: object({
+    feature: nonBlank,
+    bugfix: nonBlank,
+    release: nonBlank,
+    hotfix: nonBlank
+  }).passthrough().optional(),
+  allowed: array(nonBlank).optional(),
+  protected: array(nonBlank).optional(),
+  integration: _enum(["pr", "merge"]).optional()
+}).strict();
+var workspaceCommitPolicySchema = object({ preset: commitPreset, pattern: string2().optional() }).strict();
+var workspaceProfileSchema = object({
+  branchPolicy: workspaceBranchPolicySchema.optional(),
+  commitPolicy: workspaceCommitPolicySchema.optional()
+}).strict().refine((profile) => profile.branchPolicy !== undefined || profile.commitPolicy !== undefined, {
+  message: "a profile must define branchPolicy or commitPolicy"
+});
+var versionSourceSchema = discriminatedUnion("kind", [
+  object({
+    kind: literal("package-json"),
+    path: nonBlank,
+    field: nonBlank
+  }).strict(),
+  object({ kind: literal("git-tag") }).strict(),
+  object({ kind: literal("manual") }).strict()
+]);
+var releaseTrackSchema = object({
+  strategy: branchPreset,
+  productionBranch: nonBlank,
+  integrationBranch: nonBlank,
+  naming: object({ feature: nonBlank, release: nonBlank, hotfix: nonBlank }).strict(),
+  baseBranch: nonBlank,
+  mergeBackBranches: array(nonBlank),
+  pullRequestTarget: nonBlank,
+  tagNamespace: string2(),
+  versionSource: versionSourceSchema,
+  requiredChecks: array(nonBlank)
+}).strict().superRefine((track, context) => {
+  for (const [field, values] of [
+    ["mergeBackBranches", track.mergeBackBranches],
+    ["requiredChecks", track.requiredChecks]
+  ]) {
+    if (new Set(values).size !== values.length) {
+      context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
+    }
+  }
+  if (track.versionSource.kind === "package-json" && (path6.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+    context.addIssue({
+      code: "custom",
+      path: ["versionSource", "path"],
+      message: "must stay inside the repository"
+    });
+  }
+});
+var workspaceConfigSchema = object({
+  name: nonBlank,
+  glob: nonBlank,
+  vcs: object({
+    provider: _enum(["gitlab", "github"]),
+    defaultTargetBranch: nonBlank.optional(),
+    tokenFile: nonBlank.optional(),
+    account: nonBlank.optional()
+  }).passthrough().optional(),
+  autoApprove: union([boolean2(), array(nonBlank)]).optional(),
+  youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
+  issues: object({ provider: literal("github").optional(), link_on_pr: boolean2().optional() }).passthrough().optional(),
+  branchPolicy: workspaceBranchPolicySchema.optional(),
+  commitPolicy: workspaceCommitPolicySchema.optional(),
+  defaultProfile: nonBlank.optional(),
+  profiles: record(nonBlank, workspaceProfileSchema).optional(),
+  releaseTracks: record(nonBlank, releaseTrackSchema).optional()
+}).passthrough().superRefine((workspace, context) => {
+  if (workspace.youtrack && workspace.vcs?.provider !== "gitlab") {
+    context.addIssue({
+      code: "custom",
+      path: ["youtrack"],
+      message: `YouTrack issue linking requires the gitlab provider, got ${workspace.vcs?.provider ?? "unset"}`
+    });
+  }
+  if (workspace.issues && workspace.vcs?.provider !== "github") {
+    context.addIssue({
+      code: "custom",
+      path: ["issues"],
+      message: `GitHub issue linking requires the github provider, got ${workspace.vcs?.provider ?? "unset"}`
+    });
+  }
+  if (workspace.defaultProfile !== undefined && !Object.hasOwn(workspace.profiles ?? {}, workspace.defaultProfile)) {
+    context.addIssue({
+      code: "custom",
+      path: ["defaultProfile"],
+      message: `does not name a configured profile`
+    });
+  }
+});
+var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).optional() }).passthrough().superRefine((file, context) => {
+  const names = new Set;
+  for (const [index, workspace] of (file.workspaces ?? []).entries()) {
+    if (names.has(workspace.name)) {
+      context.addIssue({
+        code: "custom",
+        path: ["workspaces", index, "name"],
+        message: `duplicate workspace name ${JSON.stringify(workspace.name)}`
+      });
+    }
+    names.add(workspace.name);
+  }
+});
+var workspacesRevision = (contents) => createHash3("sha256").update(contents ?? "<missing>").digest("hex");
+var validateWorkspacesDocument = (parsed, file) => {
+  if (!isConfigObject(parsed)) {
+    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+  }
+  const validated = workspacesFileSchema.safeParse(parsed, { reportInput: true });
+  if (!validated.success) {
+    const detail = validated.error.issues.map((issue) => {
+      const field = String(issue.path[issue.path.length - 1] ?? "");
+      const attempted = ["provider", "preset", "strategy"].includes(field) && typeof issue.input === "string" ? ` (${JSON.stringify(issue.input)})` : "";
+      return `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}${attempted}`;
+    }).join("; ");
+    return {
+      status: "invalid",
+      path: file,
+      entries: [],
+      error: `${file} has invalid workspace configuration: ${detail}`
+    };
+  }
+  for (const [index, workspace] of (validated.data.workspaces ?? []).entries()) {
+    const glob = validateWorkspaceGlob(workspace.glob);
+    if (!glob.ok) {
+      return {
+        status: "invalid",
+        path: file,
+        entries: [],
+        error: `${file} workspaces.${index}.glob: ${glob.error}`
+      };
+    }
+  }
+  return {
+    status: "valid",
+    path: file,
+    entries: validated.data.workspaces ?? [],
+    document: parsed
+  };
+};
 var readWorkspacesResult = (dir = configDir()) => {
   const file = path6.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
-  } catch {
-    return { status: "missing", path: file, entries: [] };
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { status: "missing", path: file, entries: [], revision: workspacesRevision(null) };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      error: `${file} could not be read: ${error instanceof Error ? error.message : String(error)}`
+    };
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not valid JSON` };
-  }
-  if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      revision: workspacesRevision(raw),
+      error: `${file} is not valid JSON`
+    };
   }
-  const list = parsed.workspaces;
-  return {
-    status: "valid",
-    path: file,
-    entries: Array.isArray(list) ? list : []
-  };
+  return { ...validateWorkspacesDocument(parsed, file), revision: workspacesRevision(raw) };
 };
-var loadWorkspacesFrom = (dir) => readWorkspacesResult(dir).entries;
 var globToRegExp = (glob) => {
   let out = "";
   for (let i = 0;i < glob.length; i++) {
@@ -16867,6 +17181,30 @@ var globToRegExp = (glob) => {
   return new RegExp(`^${out}$`);
 };
 var matchWorkspace = (glob, target) => globToRegExp(glob.replaceAll("\\", "/")).test(target.replaceAll("\\", "/"));
+var UNSUPPORTED_GLOB = /[?[\]{}]/;
+var UNSUPPORTED_EXTGLOB = /[@+*]\(|!/;
+var validateWorkspaceGlob = (glob) => {
+  const trimmed = glob.trim();
+  if (!trimmed)
+    return { ok: false, error: "workspace pattern is required" };
+  const m = UNSUPPORTED_GLOB.exec(trimmed);
+  if (m) {
+    return {
+      ok: false,
+      error: `unsupported glob character ${JSON.stringify(m[0])} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
+    };
+  }
+  const ext = UNSUPPORTED_EXTGLOB.exec(trimmed);
+  if (ext) {
+    const token = ext[0];
+    const kind = token === "!" ? "negation (!)" : `extglob (${token})`;
+    return {
+      ok: false,
+      error: `unsupported glob ${kind} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
+    };
+  }
+  return { ok: true };
+};
 var realpathOf = (p) => {
   const real = realpathSync2.native ?? realpathSync2;
   try {
@@ -16884,29 +17222,137 @@ var canonicalGlob = (glob) => {
   const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
   return real + (prefix.endsWith("/") ? "/" : "") + rest;
 };
-var resolveWorkspaceFrom = (cwd, dir) => {
+var resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
+  const result = readWorkspacesResult(dir);
+  if (result.status === "malformed" || result.status === "invalid")
+    throw new Error(result.error);
   const targets = [cwd, realpathOf(cwd)].map((p) => p.replaceAll("\\", "/"));
-  for (const entry of loadWorkspacesFrom(dir)) {
-    if (!entry || typeof entry !== "object")
-      continue;
-    const ws = entry;
-    if (typeof ws.glob !== "string" || !ws.glob)
-      continue;
+  const matches = [];
+  for (const ws of result.entries) {
     const glob = ws.glob.replaceAll("\\", "/");
     const canonical = canonicalGlob(glob);
+    let matched = false;
     for (const target of targets) {
-      if (matchWorkspace(glob, target))
-        return ws;
-      if (canonical !== glob && matchWorkspace(canonical, target))
-        return ws;
+      if (matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target)) {
+        matched = true;
+        break;
+      }
     }
+    if (matched)
+      matches.push(ws);
   }
-  return null;
+  if (workspaceName !== undefined) {
+    const selected = matches.find((ws) => ws.name === workspaceName);
+    if (!selected && matches.length > 0) {
+      const matchingNames = matches.map((ws) => ws.name);
+      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matchingNames.join(", ")}`);
+    }
+    if (selected)
+      return selected;
+    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
+  }
+  if (matches.length > 1) {
+    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${matches.map((ws) => ws.name).join(", ")}`);
+  }
+  return matches[0] ?? null;
+};
+var runtimeWorkspacePolicySchema = (kind) => {
+  const key = kind === "branch" ? "branchPolicy" : kind === "commit" ? "commitPolicy" : "vcs";
+  const policySchema = kind === "branch" ? workspaceBranchPolicySchema : kind === "commit" ? workspaceCommitPolicySchema : object({
+    provider: _enum(["gitlab", "github"]),
+    defaultTargetBranch: nonBlank.optional(),
+    account: nonBlank.optional()
+  }).passthrough();
+  const profileSchema = object({ [key]: policySchema.optional() }).passthrough();
+  const entrySchema = object({
+    name: nonBlank,
+    glob: nonBlank,
+    [key]: policySchema.optional(),
+    defaultProfile: nonBlank.optional(),
+    profiles: record(nonBlank, profileSchema).optional()
+  }).passthrough();
+  return entrySchema;
+};
+var resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs");
+var runtimeWorkspaceIndexSchema = object({
+  workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
+}).passthrough();
+var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+  const file = path6.join(configDir(), "workspaces.json");
+  let raw;
+  try {
+    raw = readFileSync3(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw new Error(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`${file} is not valid JSON`);
+  }
+  const validated = runtimeWorkspaceIndexSchema.safeParse(parsed);
+  if (!validated.success) {
+    const detail = validated.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}`).join("; ");
+    throw new Error(`${file} has invalid workspace matching data: ${detail}`);
+  }
+  const entries = validated.data.workspaces;
+  for (const entry of entries ?? []) {
+    const glob = validateWorkspaceGlob(entry.glob);
+    if (!glob.ok)
+      throw new Error(`${file} workspace ${entry.name}: ${glob.error}`);
+  }
+  const targets = [cwd, realpathOf(cwd)].map((value) => value.replaceAll("\\", "/"));
+  const matches = (entries ?? []).filter((entry) => {
+    const glob = entry.glob.replaceAll("\\", "/");
+    const canonical = canonicalGlob(glob);
+    return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
+  });
+  const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
+  let selected;
+  if (workspaceName) {
+    const named = matches.filter((entry) => entry.name === workspaceName);
+    if (named.length === 1)
+      selected = named[0];
+    else if (named.length > 1)
+      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
+    else if (matches.length)
+      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
+    else
+      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
+  } else if (matches.length > 1)
+    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${matches.map((entry) => entry.name).join(", ")}`);
+  else
+    selected = matches[0];
+  if (!selected)
+    return null;
+  const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
+  if (!policy.success) {
+    const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
+    throw new Error(`${file} has invalid ${kind} policy configuration: ${detail}`);
+  }
+  return policy.data;
+};
+var resolveRuntimeWorkspacePolicy = (cwd, kind, requestedProfile) => {
+  const candidate = resolveRuntimeWorkspaceCandidate(cwd, kind);
+  if (!candidate)
+    return { policy: undefined, source: "user-default" };
+  const key = kind === "branch" ? "branchPolicy" : "commitPolicy";
+  const profileName = requestedProfile?.trim() || candidate.defaultProfile;
+  if (candidate.defaultProfile && !Object.hasOwn(candidate.profiles ?? {}, candidate.defaultProfile))
+    throw new Error(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(candidate.defaultProfile)}`);
+  const profile = profileName ? candidate.profiles?.[profileName] : undefined;
+  if (profileName && !profile)
+    throw new Error(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(profileName)}`);
+  const profilePolicy = profile?.[key];
+  const workspacePolicy = candidate[key];
+  return {
+    policy: profilePolicy ?? workspacePolicy,
+    source: profilePolicy ? `profile:${profileName}` : workspacePolicy ? `workspace:${candidate.name}` : "user-default"
+  };
 };
-var resolveWorkspace = (cwd) => resolveWorkspaceFrom(cwd, configDir());
-
-// packages/workit-core/src/core/branch.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
 
 // packages/workit-core/src/core/git.ts
 import { execFileSync } from "node:child_process";
@@ -16980,7 +17426,6 @@ var gitContext = (workspaceRoot, paths = []) => {
 import fs5 from "node:fs";
 import path7 from "node:path";
 import { spawnSync } from "node:child_process";
-var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
 var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path7.join(configDir(), "vcs.json");
 var vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
 var remoteProvider = (cwd) => {
@@ -16994,6 +17439,79 @@ var remoteProvider = (cwd) => {
     return "gitlab";
   return null;
 };
+var remoteEndpoint = (remote) => {
+  const raw = remote.trim();
+  if (!raw)
+    return null;
+  const scp = /^(?:[^@\s]+@)?([^:]+):(.+)$/u.exec(raw);
+  if (scp && !raw.includes("://"))
+    return {
+      host: scp[1].toLowerCase(),
+      path: scp[2].replace(/^\//u, "").replace(/\.git$/u, ""),
+      protocol: "ssh:",
+      port: ""
+    };
+  try {
+    const url = new URL(raw);
+    return {
+      host: url.hostname.toLowerCase(),
+      path: url.pathname.replace(/^\//u, "").replace(/\.git$/u, "").replace(/\/$/u, ""),
+      protocol: url.protocol,
+      port: url.port
+    };
+  } catch {
+    return null;
+  }
+};
+var configuredSshEndpoint = (host) => {
+  if (host.startsWith("-"))
+    return null;
+  const resolved = spawnSync("ssh", ["-G", host], {
+    encoding: "utf8",
+    timeout: 5000,
+    maxBuffer: 1024 * 1024,
+    env: { ...process.env, PATH: process.env.PATH ?? "" }
+  });
+  if (resolved.status !== 0)
+    return null;
+  const output = resolved.stdout ?? "";
+  const hostname = /^hostname\s+(\S+)/imu.exec(output)?.[1]?.toLowerCase();
+  if (!hostname)
+    return null;
+  return { host: hostname, port: /^port\s+(\d+)/imu.exec(output)?.[1] ?? "22" };
+};
+var sshApiHostAliases = {
+  "github.com": [{ host: "ssh.github.com", port: "443" }],
+  "gitlab.com": [{ host: "altssh.gitlab.com", port: "443" }]
+};
+var hostingApiHostMatches = (remote, apiHost, resolveSshEndpoint = configuredSshEndpoint) => {
+  const endpoint = remoteEndpoint(remote);
+  if (!endpoint)
+    return false;
+  let expected;
+  try {
+    const url = new URL(`https://${apiHost}`);
+    if (url.pathname !== "/" || url.search || url.hash || url.username || url.password)
+      return false;
+    expected = {
+      host: url.hostname.toLowerCase().replace(/\.$/u, ""),
+      port: url.port
+    };
+  } catch {
+    return false;
+  }
+  if (endpoint.protocol !== "ssh:") {
+    return endpoint.host.replace(/\.$/u, "") === expected.host && endpoint.port === expected.port;
+  }
+  const resolved = resolveSshEndpoint(endpoint.host);
+  if (!resolved)
+    return false;
+  const hostname = resolved.host.toLowerCase().replace(/\.$/u, "");
+  const port = endpoint.port || resolved.port;
+  if (hostname === expected.host)
+    return port === (expected.port || "22");
+  return Boolean(sshApiHostAliases[expected.host]?.some((alias) => alias.host === hostname && alias.port === port && (!expected.port || expected.port === port)));
+};
 var readVcsConfig = () => {
   const file = vcsConfigPath();
   let raw;
@@ -17014,7 +17532,7 @@ var readVcsConfig = () => {
   return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
 };
 function vcsConfig(mode, cwd) {
-  const ws = resolveWorkspace(vcsCwd(cwd));
+  const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
   const wsVcs = ws?.vcs ?? {};
   const wsYt = ws?.youtrack ?? {};
   const wsIssues = ws?.issues ?? {};
@@ -17027,8 +17545,8 @@ function vcsConfig(mode, cwd) {
   const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
   const policyDefault = resolveBranchPolicyFor(root).defaultTargetBranch;
   const defaultTarget = String(wsVcs.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : cfg.defaultTargetBranch ?? policyDefault) ?? "develop");
-  const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
-  const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
+  const linkIssues = provider === "gitlab" && typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
+  const youtrackBaseUrl = provider === "gitlab" && typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   let issuesProvider = null;
   let linkOnPr = null;
   if (provider === "github" && typeof wsIssues.provider === "string" && wsIssues.provider.toLowerCase() === "github") {
@@ -17052,9 +17570,8 @@ function vcsConfig(mode, cwd) {
   if (cfgStatus === "malformed") {
     return { ok: false, error: cfgError, configPath: cfgPath };
   }
-  if (cfgStatus === "missing") {
+  if (cfgStatus === "missing" && provider === null)
     return { ok: false, error: `vcs.json is missing: ${cfgPath}`, configPath: cfgPath };
-  }
   if (provider === null) {
     return {
       ok: false,
@@ -17063,24 +17580,12 @@ function vcsConfig(mode, cwd) {
     };
   }
   const prov = cfg[provider] ?? {};
-  const wsTokenFile = typeof wsVcs.tokenFile === "string" && wsVcs.tokenFile.trim() !== "" ? wsVcs.tokenFile : null;
-  const tokenFile = String(wsTokenFile ?? prov.tokenFile ?? path7.join(configDir(), `${provider}.token`));
-  const tokenPath = path7.resolve(tokenFile);
-  let tokenOk = false;
-  if (fs5.existsSync(tokenPath)) {
-    const token = fs5.readFileSync(tokenPath, "utf8").trim();
-    const placeholder = !token || token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER);
-    tokenOk = !placeholder;
-  }
   const out = {
     ok: true,
     configPath: path7.resolve(cfgPath),
     provider,
     defaultTargetBranch: defaultTarget,
     pr: cfg.pr ?? {},
-    tokenPath,
-    tokenPresent: fs5.existsSync(tokenPath),
-    tokenReady: tokenOk,
     workspace_name: ws?.name ?? null,
     link_issues: linkIssues,
     youtrack_base_url: youtrackBaseUrl,
@@ -17095,16 +17600,58 @@ function vcsConfig(mode, cwd) {
   } else if (provider === "github") {
     out.github = { host: prov.host ?? "github.com" };
   }
-  if (mode === "summary")
-    delete out.tokenPath;
   return out;
 }
+function vcsCliIdentity(cwd) {
+  const root = vcsCwd(cwd);
+  const cfg = vcsConfig("load", root);
+  if (!cfg.ok)
+    return { ok: false, error: cfg.error ?? "vcs config not ready" };
+  const provider = cfg.provider;
+  if (provider !== "gitlab" && provider !== "github")
+    return { ok: false, error: `unsupported provider: ${provider}` };
+  const bin = provider === "gitlab" ? "glab" : "gh";
+  const host = String(provider === "github" ? cfg.github?.host ?? "github.com" : cfg.gitlab?.host ?? "gitlab.com").toLowerCase();
+  const env = {
+    ...process.env,
+    PATH: process.env.PATH ?? "",
+    ...provider === "github" ? { GH_HOST: host } : { GITLAB_HOST: host }
+  };
+  const result = spawnSync(bin, ["api", "user"], {
+    cwd: root,
+    encoding: "utf8",
+    env
+  });
+  if (result.status !== 0)
+    return { ok: false, provider, error: `${bin} is missing or not authenticated` };
+  try {
+    const user = JSON.parse(result.stdout ?? "");
+    const username = provider === "gitlab" ? user.username : user.login;
+    if (typeof username !== "string" || !username)
+      return { ok: false, provider, error: `invalid ${bin} identity response` };
+    const expected = resolveRuntimeWorkspaceVcs(root)?.vcs?.account;
+    if (expected && username.toLowerCase() !== expected.toLowerCase())
+      return {
+        ok: false,
+        provider,
+        error: `${bin} account ${username} does not match ${expected}`
+      };
+    return { ok: true, provider, host, username, name: user.name };
+  } catch {
+    return { ok: false, provider, error: `invalid JSON from ${bin} api user` };
+  }
+}
 function mergedPrStyle(limit = 6, cwd) {
   const cfg = vcsConfig("load", cwd);
-  if (!cfg.ok || !cfg.tokenReady)
+  if (!cfg.ok)
     return { ok: false, error: "vcs not configured" };
   const provider = cfg.provider;
-  const token = fs5.readFileSync(cfg.tokenPath, "utf8").trim();
+  const host = String(provider === "github" ? cfg.github?.host ?? "github.com" : cfg.gitlab?.host ?? "gitlab.com").toLowerCase();
+  const env = {
+    ...process.env,
+    PATH: process.env.PATH ?? "",
+    ...provider === "github" ? { GH_HOST: host } : { GITLAB_HOST: host }
+  };
   const examples = [];
   const descInfo = (desc, caseInsensitiveNotes = false) => ({
     hasNotesSection: caseInsensitiveNotes ? /##\s*notes/i.test(desc) : /##\s*Notes/.test(desc),
@@ -17112,23 +17659,30 @@ function mergedPrStyle(limit = 6, cwd) {
 `).filter((l) => l.startsWith("## ")).map((l) => l.trim()),
     descriptionPreview: desc.slice(0, 600)
   });
+  const remoteResult = spawnSync("git", ["remote", "get-url", "--push", "--all", "origin"], {
+    cwd,
+    encoding: "utf8"
+  });
+  const remotes = (remoteResult.stdout ?? "").split(/\r?\n/u).map((value) => value.trim()).filter(Boolean);
+  if (remotes.length === 0)
+    return { ok: false, error: "no origin remote" };
+  if (remotes.length !== 1)
+    return { ok: false, error: "origin has ambiguous push destinations" };
+  const remote = remotes[0];
+  const endpoint = remoteEndpoint(remote);
+  if (!endpoint?.path)
+    return { ok: false, error: "hosting repository could not be resolved" };
+  if (!hostingApiHostMatches(remote, host))
+    return { ok: false, error: "PR style target does not match the provider host" };
   if (provider === "gitlab") {
-    const remote = spawnSync("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
-    if (remote.status !== 0)
-      return { ok: false, error: "no origin remote" };
-    const url = (remote.stdout ?? "").trim();
-    const m = /gitlab\.com[:/](.+?)(?:\.git)?$/.exec(url);
-    if (!m)
-      return { ok: false, error: "not a gitlab.com origin" };
-    const project = m[1];
-    const env = { ...process.env, GITLAB_TOKEN: token };
-    const run = (args) => spawnSync("glab", ["api", ...args], { cwd, encoding: "utf8", env });
+    const run = (args) => spawnSync("glab", ["api", ...args], {
+      cwd,
+      encoding: "utf8",
+      env
+    });
     let r = run([
-      `projects/${project.replaceAll("/", "%2F")}/merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`
+      `projects/${endpoint.path.replaceAll("/", "%2F")}/merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`
     ]);
-    if (r.status !== 0) {
-      r = run([`merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`]);
-    }
     if (r.status !== 0)
       return { ok: false, error: "could not list merge requests" };
     for (const mr of JSON.parse(r.stdout ?? "[]")) {
@@ -17141,7 +17695,18 @@ function mergedPrStyle(limit = 6, cwd) {
       });
     }
   } else if (provider === "github") {
-    const r = spawnSync("gh", ["pr", "list", "--state", "merged", "--limit", String(limit), "--json", "title,url,body"], { cwd, encoding: "utf8", env: { ...process.env, GH_TOKEN: token } });
+    const r = spawnSync("gh", [
+      "pr",
+      "list",
+      "--repo",
+      `${host}/${endpoint.path}`,
+      "--state",
+      "merged",
+      "--limit",
+      String(limit),
+      "--json",
+      "title,url,body"
+    ], { cwd, encoding: "utf8", env });
     if (r.status !== 0)
       return { ok: false, error: "could not list pull requests" };
     for (const pr of JSON.parse(r.stdout ?? "[]")) {
@@ -17163,26 +17728,28 @@ function mergedPrStyle(limit = 6, cwd) {
 }
 
 // packages/workit-core/src/core/branch.ts
-var resolveBranchPolicyFor = (workspaceRoot) => resolveBranchPolicy(readConfig(), resolveWorkspace(workspaceRoot));
+function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
+  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
+  const config = readConfig();
+  return kind === "branch" ? {
+    branchPolicy: resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null),
+    provenance: { branchPolicy: selected.source }
+  } : {
+    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
+    provenance: { commitPolicy: selected.source }
+  };
+}
+var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
 var verifyPushIdentity = (root, provider, account) => {
   if (!account || typeof account !== "string")
     return { ok: false, error: "push identity requires a configured area account" };
-  const probe = provider === "gitlab" ? ["api", "user", "--jq", ".username"] : ["api", "user", "--jq", ".login"];
-  const bin = provider === "gitlab" ? "glab" : "gh";
-  let login;
-  try {
-    login = execFileSync2(bin, [...probe], {
-      cwd: root,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-  } catch {
-    return { ok: false, error: `${bin} identity could not be resolved` };
-  }
-  if (!login || login.toLowerCase() !== account.toLowerCase())
+  const identity = vcsCliIdentity(root);
+  if (!identity.ok || identity.provider !== provider)
+    return { ok: false, error: identity.error ?? "hosting CLI identity could not be resolved" };
+  if (identity.username?.toLowerCase() !== account.toLowerCase())
     return {
       ok: false,
-      error: `push identity ${login || "(unknown)"} does not match area account ${account}`
+      error: `push identity ${identity.username || "(unknown)"} does not match area account ${account}`
     };
   return { ok: true };
 };
@@ -17200,7 +17767,7 @@ var operationAutoClass = (operation) => typeof operation === "string" ? OPERATIO
 var digestOf = (configDirPath) => {
   try {
     const raw = readFileSync4(`${configDirPath}/workspaces.json`, "utf8");
-    return createHash3("sha256").update(raw).digest("hex");
+    return createHash4("sha256").update(raw).digest("hex");
   } catch {
     return null;
   }
@@ -17238,14 +17805,30 @@ var resolveAutoApproval = (root, dir = configDir()) => {
   };
 };
 var isStandingReceipt = (value) => typeof value === "object" && value !== null && value.kind === "standing";
-var standingApprovalLive = (root, receipt, cls, dir) => {
+var targetOf = (root, descriptor) => {
+  try {
+    const parsed = typeof descriptor === "string" ? JSON.parse(descriptor) : descriptor;
+    const cwd = parsed?.payload?.cwd;
+    if (cwd === undefined)
+      return root;
+    if (typeof cwd !== "string" || !path8.isAbsolute(cwd))
+      return null;
+    return realpathSync3(cwd);
+  } catch {
+    return null;
+  }
+};
+var standingApprovalLive = (root, receipt, cls, dir, descriptor) => {
   if (!isStandingReceipt(receipt))
     return false;
   if (typeof cls !== "string" || !AUTO_CLASSES.includes(cls))
     return false;
   if (receipt.class !== cls)
     return false;
-  const resolved = resolveAutoApproval(root, dir);
+  const target = targetOf(root, descriptor);
+  if (!target)
+    return false;
+  const resolved = resolveAutoApproval(target, dir);
   if (resolved.status !== "on")
     return false;
   if (resolved.workspace !== receipt.workspace)
@@ -17264,9 +17847,11 @@ var standingReceiptFor = (root, workspace, cls, dir) => {
 var verifyStandingApproval = (root, task, caller, binding) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
-  const session = task.intent?.provenance?.session;
-  if (!session || session.kind !== "host" || session.host !== caller.host || session.handle !== caller.actor)
-    return failure("permission_denied", "standing approval requires the lead session");
+  const workspace = new TaskStore(root).readWorkspace();
+  if (!workspace.ok)
+    return workspace;
+  if (!workspace.data || !currentWriterOwnsTask(task, workspace.data, caller))
+    return failure("permission_denied", "standing approval requires the current writer session");
   const standing = binding.standing;
   if (!standing || typeof standing.workspace !== "string" || typeof standing.class !== "string")
     return failure("invalid_input", "standing approval needs a workspace and class");
@@ -17279,16 +17864,19 @@ var verifyStandingApproval = (root, task, caller, binding) => {
   const cls = operationAutoClass(operation);
   if (!cls || cls !== standing.class)
     return failure("permission_denied", "standing approval does not cover this operation");
-  const resolved = resolveAutoApproval(root);
+  const target = targetOf(root, binding.approvedContent);
+  if (!target)
+    return failure("permission_denied", "standing action target is invalid");
+  const resolved = resolveAutoApproval(target);
   if (resolved.status !== "on" || resolved.workspace !== standing.workspace || !resolved.classes.includes(cls))
     return failure("permission_denied", "standing auto-approval is not live for this operation");
   if (cls === "push") {
-    const workspace = resolveWorkspaceFrom(root, configDir());
+    const workspace = resolveWorkspaceFrom(target, configDir());
     const provider = workspace?.vcs?.provider;
     const account = resolved.account;
     if (!provider || !account)
       return failure("permission_denied", "auto-push requires a workspace provider and area account");
-    const identity = verifyPushIdentity(root, provider, account);
+    const identity = verifyPushIdentity(target, provider, account);
     if (!identity.ok)
       return failure("permission_denied", identity.error);
   }
@@ -17297,7 +17885,7 @@ var verifyStandingApproval = (root, task, caller, binding) => {
     host: caller.host,
     session: { kind: "host", host: caller.host, handle: caller.actor },
     workerId: null,
-    receipts: [standingReceiptFor(root, standing.workspace, cls)]
+    receipts: [standingReceiptFor(target, standing.workspace, cls)]
   });
 };
 
@@ -17448,7 +18036,7 @@ function applicableDecision(task, purpose, binding, checkoutRoot) {
     return [];
   return task.decisions.filter((entry) => entry.provenance.kind !== "imported" && decisionMatches(entry, purpose, binding) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, entry.data.binding).ok : entry.data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map((entry) => entry.data);
 }
-var digestBytes2 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
+var digestBytes2 = (bytes) => createHash5("sha256").update(bytes).digest("hex");
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
@@ -17461,23 +18049,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure("invalid_input", "document references require a byte digest");
-    const target = path8.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path8.sep}`))
+    const target = path9.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path9.sep}`))
       return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const relative = path8.relative(root, target);
+      const relative = path9.relative(root, target);
       let current = root;
-      for (const segment of relative.split(path8.sep)) {
+      for (const segment of relative.split(path9.sep)) {
         if (!segment)
           continue;
-        current = path8.join(current, segment);
+        current = path9.join(current, segment);
         const stat = fs6.lstatSync(current);
         const real = fs6.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path8.sep}`))
+        if (real !== root && !real.startsWith(`${root}${path9.sep}`))
           return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -17503,6 +18091,20 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
 };
 var verifyContentRefs = (store, binding) => verifyDecisionContentAtRoot(store.root, binding);
 var storedDecisionApplicable = (store, task, purpose, binding) => task.decisions.filter((entry) => entry.provenance.kind !== "imported" && decisionMatches(entry, purpose, binding) && verifyDecisionContentAtRoot(store.root, entry.data.binding).ok);
+var approvalAuthorityMatches = (store, task, approval, current) => {
+  if (approval.kind !== "host_observed" || approval.receipts.length === 0)
+    return false;
+  if (provenanceMatches(approval, current))
+    return true;
+  const session = current.kind === "host_observed" ? current.session : null;
+  if (!session || session.kind !== "host")
+    return false;
+  const workspace = store.readWorkspace();
+  return workspace.ok && workspace.data !== null && currentWriterOwnsTask(task, workspace.data, {
+    host: session.host,
+    actor: session.handle
+  });
+};
 var validateAction = (store, task, workspaceId, input, authority) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
@@ -17528,7 +18130,7 @@ var validateAction = (store, task, workspaceId, input, authority) => {
     return failure("permission_denied", "native reservation authority does not match decision");
   if (decision.response !== "approved")
     return failure("permission_denied", "decision was rejected");
-  if (entry.provenance.kind !== "host_observed" || entry.provenance.receipts.length === 0 || !provenanceMatches(entry.provenance, authority.provenance))
+  if (!approvalAuthorityMatches(store, task, entry.provenance, authority.provenance))
     return failure("permission_denied", "action approval lacks native receipt assurance");
   const receipts = entry.provenance.receipts;
   const standing = receipts.filter((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "standing");
@@ -17541,7 +18143,7 @@ var validateAction = (store, task, workspaceId, input, authority) => {
       operation = null;
     }
     const cls = operationAutoClass(operation);
-    if (!cls || !standing.some((receipt) => standingApprovalLive(store.root, receipt, cls)))
+    if (!cls || !standing.some((receipt) => standingApprovalLive(store.root, receipt, cls, undefined, decision.binding.approvedContent)))
       return failure("permission_denied", "standing auto-approval is not live for this operation");
   }
   if (decision.revoked)
@@ -17695,7 +18297,7 @@ function settleAction(input) {
       return failure("not_found", "decision not found");
     if (!authorityDecisionMatches(authority, entry.data))
       return failure("permission_denied", "native settlement authority does not match decision");
-    if (!provenanceMatches(entry.provenance, authority.provenance))
+    if (!approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native settlement caller does not match approval");
     if (entry.data.purpose !== "action" || entry.data.digest !== decisionDigest(entry.data))
       return failure("permission_denied", "decision binding is invalid");
@@ -17794,7 +18396,7 @@ function reconcileAction(input) {
     const entry = current.decisions.find((candidate) => candidate.id === input.decisionId);
     if (!entry || entry.data.purpose !== "action")
       return failure("not_found", "decision not found");
-    if (!authorityDecisionMatches(authority, entry.data) || !provenanceMatches(entry.provenance, authority.provenance))
+    if (!authorityDecisionMatches(authority, entry.data) || !approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native reconciliation caller does not match approval");
     if (entry.data.response !== "approved" || entry.data.revoked !== null || entry.data.digest !== decisionDigest(entry.data) || entry.data.binding.taskId !== current.id || entry.data.binding.workspaceId !== current.workspaceId || entry.data.binding.workspaceId !== workspace.data.id)
       return failure("permission_denied", "reconciliation decision binding is invalid");
@@ -17843,15 +18445,15 @@ var bindingCovers = scopeCovers;
 var verifyDecisionContent = verifyContentRefs;
 
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes3 = (value) => createHash5("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path9.sep}`);
-var relative = (root, candidate) => path9.relative(root, candidate).split(path9.sep).join("/") || ".";
+var digestBytes3 = (value) => createHash6("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path10.sep}`);
+var relative = (root, candidate) => path10.relative(root, candidate).split(path10.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path9.posix.normalize(value);
+  const normalized = path10.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -17899,14 +18501,14 @@ var gitPaths = (root) => {
       git: /not a git repository/i.test(stderr) ? false : true
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path9.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")) : [];
   const stagedDeleted = spawnSync2("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path9.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
@@ -17921,7 +18523,7 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path9.join(directory, name);
+    const target = path10.join(directory, name);
     let stat;
     try {
       stat = fs7.lstatSync(target);
@@ -17939,12 +18541,12 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path9.resolve(root, item);
+    const target = path10.resolve(root, item);
     if (!inside(root, target))
       return failure("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
     while (!fs7.existsSync(ancestor) && ancestor !== root)
-      ancestor = path9.dirname(ancestor);
+      ancestor = path10.dirname(ancestor);
     try {
       if (!inside(root, fs7.realpathSync(ancestor)))
         return failure("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
@@ -17996,7 +18598,7 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].sort()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path9.join(checkout, item);
+    const target = path10.join(checkout, item);
     try {
       const stat = fs7.lstatSync(target);
       if (stat.isSymbolicLink()) {
@@ -18131,7 +18733,7 @@ var resolveBinding = (evidence, pin, currentCandidateId) => {
     candidateId: evidence.candidateId ?? fallback
   };
 };
-var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId === findingCandidateId);
+var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId != null);
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
 var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
 var evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
@@ -18366,6 +18968,11 @@ var exportDigest = (bundle) => sha256({
   task: bundle.task
 });
 // packages/workit-core/src/core/external-action.ts
+var chainStepSchema = union([
+  string2().min(1),
+  object({ branch: string2().min(1) }).strict(),
+  object({ pr: literal(true) }).strict()
+]);
 var externalActionSchema = discriminatedUnion("operation", [
   object({
     operation: literal("git.branch_setup"),
@@ -18373,20 +18980,22 @@ var externalActionSchema = discriminatedUnion("operation", [
       action: _enum(["setup", "reapply_stash"]).optional(),
       sdd_dir: string2().optional(),
       target_branch: string2().optional(),
-      stash: _enum(["yes", "no"]).optional()
+      stash: _enum(["yes", "no"]).optional(),
+      cwd: string2().min(1).optional()
     }).strict()
   }).strict(),
   object({
     operation: literal("git.commit"),
     payload: object({
       message: string2().min(1).optional(),
-      plan_steps: array(string2().min(1)).optional(),
-      plan_branch: string2().min(1).optional()
+      plan_steps: array(chainStepSchema).min(1).max(32).optional(),
+      plan_branch: string2().min(1).optional(),
+      cwd: string2().min(1).optional()
     }).strict()
   }).strict(),
   object({
     operation: literal("git.push"),
-    payload: object({ branch: string2().min(1).optional() }).strict()
+    payload: object({ branch: string2().min(1).optional(), cwd: string2().min(1).optional() }).strict()
   }).strict(),
   object({
     operation: literal("hosting.pull_request"),
@@ -18395,16 +19004,22 @@ var externalActionSchema = discriminatedUnion("operation", [
       body: string2().optional(),
       draft: boolean2().optional(),
       target_branch: string2().optional(),
-      babysit: boolean2().optional()
+      babysit: boolean2().optional(),
+      cwd: string2().min(1).optional()
     }).strict()
   }).strict(),
   object({
     operation: literal("hosting.merge"),
     payload: object({
       target_branch: string2().min(1).optional(),
-      source_branch: string2().min(1).optional()
+      source_branch: string2().min(1).optional(),
+      cwd: string2().min(1).optional()
     }).strict()
   }).strict(),
+  object({
+    operation: literal("hosting.delete_branch"),
+    payload: object({ branch: string2().min(1), cwd: string2().min(1).optional() }).strict()
+  }).strict(),
   object({
     operation: literal("youtrack.update"),
     payload: object({
@@ -18460,12 +19075,13 @@ var externalActionSchema = discriminatedUnion("operation", [
       issueRef: string2().optional(),
       mode: string2().optional(),
       specPath: string2().optional(),
-      planPath: string2().optional()
+      planPath: string2().optional(),
+      cwd: string2().min(1).optional()
     }).strict()
   }).strict()
 ]);
 // packages/workit-core/src/core/task-engine.ts
-import { realpathSync as realpathSync5 } from "node:fs";
+import { realpathSync as realpathSync6 } from "node:fs";
 
 // packages/workit-core/src/core/policy-resolver.ts
 var resolverInputSchema = object({
@@ -18866,6 +19482,7 @@ var verifyNativeWorker = (verifier, input, binding) => {
     expectedWorkspaceRevision: expected.expectedWorkspaceRevision,
     state: expected.state,
     session: expected.session,
+    report: expected.report ?? null,
     provenance: result.data,
     ...binding
   });
@@ -18876,7 +19493,7 @@ var takeWorker = (token, binding, expected) => {
   verifiedWorkers.delete(token);
   if (!value)
     return null;
-  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session))
+  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session) || !sameValue(value.report, expected.report ?? null))
     return null;
   return value;
 };
@@ -18917,6 +19534,8 @@ var applyWorkerLifecycle = (input) => {
     return failure("invalid_transition", "worker already has an observed session");
   if (notStarted && !["dispatching", "cancelling"].includes(entry.data.state))
     return failure("invalid_transition", "worker launch was not claimed");
+  if (input.report && input.state !== "stopped")
+    return failure("invalid_input", "worker reports require a stopped worker");
   if ((input.state === "running" || input.state === "cancelling" || input.state === "stopped" && !notStarted) && !input.session)
     return failure("invalid_input", "running worker observations require a session");
   if (entry.data.session && !sameValue(entry.data.session, input.session))
@@ -18933,12 +19552,13 @@ var applyWorkerLifecycle = (input) => {
     data: {
       ...entry.data,
       state: terminalCancel ? "cancelling" : input.state,
-      session: input.session
+      session: input.session,
+      report: entry.data.report ?? input.report ?? null
     }
   };
   const shouldClear = input.state === "stopped" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
   const shouldUncertain = input.state === "unknown" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
-  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && !shouldClear && !shouldUncertain)
+  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && sameValue(entry.data.report, nextEntry.data.report) && !shouldClear && !shouldUncertain)
     return success(task.data.revision, workspace.data.revision, entry);
   const changed = input.store.mutateTaskAndWorkspace({
     taskId: task.data.id,
@@ -19006,6 +19626,18 @@ var portableTask = (task) => {
   };
   for (const entry of clone.assessments)
     demote(entry.data.facts, entry.data.signals, entry.data.consequences);
+  const sourceDecisions = new Map(task.decisions.map((entry) => [entry.id, entry]));
+  for (const entry of clone.decisions) {
+    const consumption = sourceDecisions.get(entry.id)?.data.consumption;
+    if (!consumption)
+      continue;
+    entry.data.consumption = {
+      ...consumption,
+      state: consumption.state === "reserved" ? "uncertain" : consumption.state,
+      actionRef: { kind: "record", collection: "decisions", id: entry.id },
+      ...consumption.historicalActionId ? { historicalActionId: consumption.historicalActionId } : consumption.actionRef.kind === "host" ? { historicalActionId: consumption.actionRef.handle } : {}
+    };
+  }
   clone.candidates = [];
   return clone;
 };
@@ -19131,7 +19763,11 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
             taskId: "",
             workspaceId: destinationWorkspaceId
           },
-          consumption: null
+          consumption: data.consumption ? {
+            ...data.consumption,
+            state: data.consumption.state === "reserved" ? "uncertain" : data.consumption.state,
+            actionRef: { kind: "record", collection: "decisions", id: entry.id }
+          } : null
         }
       };
     }),
@@ -19172,7 +19808,7 @@ class WorkitCore {
   }
   contextRootError() {
     try {
-      if (realpathSync5(this.context.root) !== this.store.root)
+      if (realpathSync6(this.context.root) !== this.store.root)
         return failure("invalid_input", "operation context root does not match the task store root");
     } catch {
       return failure("invalid_input", "operation context root cannot be resolved");
@@ -19331,7 +19967,7 @@ class WorkitCore {
       return parsed;
     const input = parsed.data;
     if ((this.context.workerId ?? null) !== null) {
-      if (input.action !== "inspect")
+      if (input.action !== "inspect" && input.action !== "list")
         return failure("permission_denied", "helpers cannot control task lifecycle or scope");
     }
     switch (input.action) {
@@ -19356,14 +19992,45 @@ class WorkitCore {
         const listed = this.store.listTasks();
         if (!listed.ok)
           return listed;
-        const summaries = [];
-        for (const task of listed.data) {
-          const summary = this.summary(task);
-          if (!summary.ok)
-            return summary;
-          summaries.push(summary.data);
-        }
-        return success(null, null, summaries);
+        const status = input.status ?? "open";
+        const limit = input.limit ?? 20;
+        const query = input.query?.toLowerCase().split(/\s+/);
+        const selected = listed.data.filter((task) => status === "all" ? true : status === "closed" ? task.status === "closed" : task.status !== "closed").filter((task) => !query || query.every((term) => JSON.stringify({
+          id: task.id,
+          workspaceId: task.workspaceId,
+          origin: task.origin,
+          createdAt: task.createdAt,
+          updatedAt: task.updatedAt,
+          source: task.intent.provenance,
+          objective: task.intent.data.objective,
+          progress: task.progress,
+          decisions: task.decisions.map(({ data }) => data)
+        }).toLowerCase().includes(term))).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, limit);
+        if (selected.length === 0)
+          return success(null, null, []);
+        const workspace = this.store.readWorkspace();
+        if (!workspace.ok)
+          return workspace;
+        if (!workspace.data)
+          return failure("not_found", "workspace not found");
+        const tasks = selected.map((task) => ({
+          id: task.id,
+          revision: task.revision,
+          workspaceRevision: workspace.data.revision,
+          createdAt: task.createdAt,
+          updatedAt: task.updatedAt,
+          runtime: task.runtime ?? null,
+          objective: task.intent.data.objective,
+          status: task.status,
+          closure: task.closure,
+          progress: task.progress,
+          writer: task.status === "closed" ? null : workspace.data.writer,
+          source: {
+            host: task.intent.provenance.host,
+            kind: task.intent.provenance.kind
+          }
+        }));
+        return success(null, null, tasks);
       }
       case "inspect": {
         const task = this.store.readTask(input.taskId);
@@ -19372,7 +20039,7 @@ class WorkitCore {
         const helper = this.helperTaskGuard(task.data, true);
         if (!helper.ok)
           return helper;
-        if (input.view === "summary")
+        if ((input.view ?? "summary") === "summary")
           return this.summary(task.data);
         return this.view(task.data);
       }
@@ -19716,7 +20383,7 @@ class WorkitCore {
       const evaluations = evaluateEvidence(task.data, current.data);
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
-        return findingVerificationPasses(finding.data.candidateId, {
+        return entry.recordedAt >= finding.recordedAt && findingVerificationPasses(finding.data.candidateId, {
           kind: entry.data.kind,
           candidateId: entry.data.candidateId,
           status: evaluation?.status ?? "missing"
@@ -19796,7 +20463,18 @@ class WorkitCore {
       if (task.data.status !== "active")
         return failure("invalid_transition", "paused or closed tasks cannot assign workers");
       if (!bindingCovers(task.data.intent.data.scope, input.assignment.scope))
-        return failure("permission_denied", "worker assignment is outside task scope");
+        return failure("permission_denied", "worker assignment is outside task scope", {
+          fields: [
+            {
+              path: "assignment.scope",
+              reason: `paths ${JSON.stringify(input.assignment.scope.paths)} must be contained by lead paths ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            },
+            {
+              path: "task.intent.scope",
+              reason: `lead paths are ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            }
+          ]
+        });
       if (input.assignment.decisionIds.some((id) => !task.data.decisions.some((entry) => entry.id === id)))
         return failure("invalid_input", "worker assignment references an unknown decision");
       if (input.assignment.requirementIds.some((id) => !task.data.policy?.requirements.some((requirement) => requirement.id === id)))
@@ -20003,7 +20681,15 @@ class WorkitCore {
             ...item,
             recordedAt: mutation.now,
             provenance: attested.data,
-            data: { ...item.data, state: "dispatching" }
+            data: {
+              ...item.data,
+              state: "dispatching",
+              coordinator: {
+                kind: "host",
+                host: this.context.caller.host,
+                handle: this.context.caller.actor
+              }
+            }
           } : item)
         });
       }
@@ -20079,6 +20765,7 @@ class WorkitCore {
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         state: "stopped",
         session: null,
+        report: null,
         provenance: attested.data,
         owner: this.authorityOwner,
         store: this.store,
@@ -20386,10 +21073,12 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       id: task.id,
       revision: task.revision,
@@ -20403,7 +21092,7 @@ class WorkitCore {
       progress: task.progress,
       policy: task.policy,
       requirements,
-      writer: workspace.data.writer
+      writer: evaluationWorkspace.writer
     });
   }
   view(task) {
@@ -20412,13 +21101,15 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       task,
-      workspace: workspace.data,
+      workspace: evaluationWorkspace,
       capabilities: this.context.capabilities,
       requirements,
       evidence: evaluateEvidence(task, current.data)
@@ -20433,7 +21124,7 @@ class WorkitCore {
     if (view.task.workspaceId !== view.workspace.id)
       return failure("invalid_input", "task and workspace bindings are invalid");
     try {
-      if (realpathSync5(view.workspace.root) !== this.store.root)
+      if (realpathSync6(view.workspace.root) !== this.store.root)
         return failure("invalid_input", "task view root does not match the task store");
     } catch {
       return failure("invalid_input", "task view root cannot be resolved");
@@ -20509,8 +21200,6 @@ class WorkitCore {
       return helper;
     if (status === "paused" && task.data.status !== "active" || status === "active" && task.data.status !== "paused")
       return failure("invalid_transition", `cannot transition ${task.data.status} to ${status}`);
-    if (status === "active" && input.authorityRefs.length === 0)
-      return failure("permission_denied", "resuming a task requires authority references");
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
@@ -20540,7 +21229,7 @@ class WorkitCore {
         return failure("needs_input", "imported task requires fresh destination evidence");
       if (current.data.blockers.some((blocker) => blocker.dependentAction === "resume" || blocker.reason === "worker state requires reconciliation"))
         return failure("recovery_required", "imported task requires resume reconciliation");
-      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs, this.context))
+      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs ?? [], this.context))
         return failure("permission_denied", "imported resume requires native destination approval");
       resumeCandidate = current.data.candidate;
     }
@@ -20670,7 +21359,7 @@ class WorkitCore {
       task: (value, context) => success(context.revision, null, {
         ...value,
         status: "closed",
-        candidates: value.candidates.some((item) => item.id === withCandidate.id) ? value.candidates : [...value.candidates, withCandidate],
+        candidates: taskForView.candidates,
         closure: {
           outcome: closure.data.outcome,
           at: context.now,
@@ -20712,22 +21401,22 @@ function resolveGitRevision(root, value) {
   }
 }
 function resolveInside(root, candidate) {
-  const base = realpathSync6(root);
-  const target = path10.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path10.sep)) {
+  const base = realpathSync7(root);
+  const target = path11.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path11.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
   while (!existsSync5(ancestor))
-    ancestor = path10.dirname(ancestor);
-  const canonicalAncestor = realpathSync6(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path10.sep)) {
+    ancestor = path11.dirname(ancestor);
+  const canonicalAncestor = realpathSync7(ancestor);
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path11.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
 }
 function run2(root, executable, args, env = {}) {
-  const cwd = realpathSync6(root);
+  const cwd = realpathSync7(root);
   const result = spawnSync3(executable, args, {
     cwd,
     encoding: "utf8",
@@ -20751,8 +21440,8 @@ var SUPPORT_MATRIX = {
 };
 
 // packages/workit-mcp/src/server.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8, realpathSync as realpathSync7 } from "node:fs";
-import path14 from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync8, realpathSync as realpathSync8 } from "node:fs";
+import path15 from "node:path";
 
 // node_modules/@modelcontextprotocol/sdk/node_modules/zod/v4/core/core.js
 var NEVER2 = Object.freeze({
@@ -24279,7 +24968,7 @@ function check(fn) {
   ch._zod.check = fn;
   return ch;
 }
-function custom(fn, _params) {
+function custom2(fn, _params) {
   return _custom2(ZodCustom2, fn ?? (() => true), _params);
 }
 function refine2(fn, _params = {}) {
@@ -24316,7 +25005,7 @@ var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
 var RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
 var JSONRPC_VERSION = "2.0";
-var AssertObjectSchema = custom((v) => v !== null && (typeof v === "object" || typeof v === "function"));
+var AssertObjectSchema = custom2((v) => v !== null && (typeof v === "object" || typeof v === "function"));
 var ProgressTokenSchema = union2([string4(), number4().int()]);
 var CursorSchema = string4();
 var TaskCreationParamsSchema = looseObject({
@@ -26662,18 +27351,19 @@ var redactSecrets = (value) => applyPatterns(value);
 
 // packages/workit-core/src/core/pr-create.ts
 import fs8 from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
 function parseGhIssue(value) {
   const m = /issues\/(\d+)/.exec(value);
   return m ? m[1] : String(value).trim().replace(/^#/, "");
 }
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path11.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path12.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path11.join(dir, name);
+      const candidate = path12.join(dir, name);
       try {
         fs8.accessSync(candidate, fs8.constants.X_OK);
         return candidate;
@@ -26683,11 +27373,21 @@ function whichOnPath(tool) {
   return null;
 }
 var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
+var pushRemote = (cwd) => {
+  const result = spawnSync4("git", ["remote", "get-url", "--push", "--all", "origin"], {
+    cwd,
+    encoding: "utf8"
+  });
+  if (result.status !== 0)
+    return null;
+  const urls = (result.stdout ?? "").split(/\r?\n/u).map((url) => url.trim()).filter(Boolean);
+  return urls.length === 1 ? urls[0] : null;
+};
 
 // packages/workit-core/src/core/repo-context.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync7, readdirSync as readdirSync4 } from "node:fs";
-import path12 from "node:path";
+import path13 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -26714,7 +27414,7 @@ var invalidRange = (cwd) => ({
   cwd
 });
 var runGit = (cwd, args) => {
-  const result = spawnSync4("git", args, { cwd, encoding: "utf8" });
+  const result = spawnSync5("git", args, { cwd, encoding: "utf8" });
   return {
     stdout: (result.stdout ?? "").trimEnd(),
     stderr: (result.stderr ?? "").trimEnd(),
@@ -26821,7 +27521,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path12.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path13.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -26852,7 +27552,7 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path12.join(cwd, "package.json");
+  const pkgPath = path13.join(cwd, "package.json");
   if (!existsSync6(pkgPath))
     return [];
   try {
@@ -26878,9 +27578,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path12.join(dir, entry.name), depth + 1);
+        walk(path13.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path12.relative(cwd, path12.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path13.relative(cwd, path13.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -26896,7 +27596,7 @@ var readTrimmed = (file, maxLines) => {
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path12.resolve(repoRoot(root));
+  const cwd = path13.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -26954,7 +27654,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 
 `;
-    stdout += readTrimmed(path12.join(cwd, template), 220);
+    stdout += readTrimmed(path13.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
 
@@ -26964,7 +27664,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync6(path12.join(cwd, "package.json"))) {
+  if (existsSync6(path13.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -26973,7 +27673,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync6(path12.join(cwd, "Cargo.toml")) || existsSync6(path12.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync6(path13.join(cwd, "Cargo.toml")) || existsSync6(path13.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -27006,7 +27706,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the native workit_changelog_apply tool only (not hand-edits under Unreleased).
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path12.resolve(repoRoot(root));
+  const cwd = path13.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -27024,7 +27724,7 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path12.join(cwd, "CHANGELOG.md");
+  const changelogPath = path13.join(cwd, "CHANGELOG.md");
   if (existsSync6(changelogPath)) {
     stdout += readTrimmed(changelogPath, 260) + `
 `;
@@ -27044,7 +27744,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path12.resolve(repoRoot(root));
+  const cwd = path13.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -27066,7 +27766,7 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path12.join(cwd, "README.md");
+  const readme = path13.join(cwd, "README.md");
   if (existsSync6(readme)) {
     stdout += readTrimmed(readme, 220) + `
 `;
@@ -27075,7 +27775,7 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path12.join(cwd, "package.json");
+  const pkgPath = path13.join(cwd, "package.json");
   if (existsSync6(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
@@ -27089,7 +27789,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path12.resolve(repoRoot(root));
+  const cwd = path13.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -27127,7 +27827,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync6(path12.join(cwd, rel)))
+    if (existsSync6(path13.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -27155,19 +27855,7 @@ function releaseNotesContext(root, rangeOrTag) {
 }
 
 // packages/workit-core/src/core/tracker-issues.ts
-import fs9 from "node:fs";
-import { spawnSync as spawnSync5 } from "node:child_process";
-var trackerRequest = async (url, init) => {
-  try {
-    const res = await fetch(url, { method: init.method, headers: init.headers });
-    const text = await res.text();
-    if (!res.ok)
-      return { status: res.status, stdout: "", stderr: text.slice(0, 200) };
-    return { status: 0, stdout: text, stderr: "" };
-  } catch (err) {
-    return { status: 1, stdout: "", stderr: err instanceof Error ? err.message : "network error" };
-  }
-};
+import { spawnSync as spawnSync6 } from "node:child_process";
 var repoPathFromRemote = (remote) => {
   let rest = (remote || "").trim().replace(/\/+$/, "");
   if (!rest)
@@ -27188,7 +27876,11 @@ var defaultCli = (bin, available) => {
   if (!available)
     return null;
   return (args, root) => {
-    const out = spawnSync5(bin, args, { cwd: root, encoding: "utf8" });
+    const out = spawnSync6(bin, args, {
+      cwd: root,
+      encoding: "utf8",
+      env: { ...process.env, PATH: process.env.PATH ?? "" }
+    });
     return Promise.resolve({
       status: out.status ?? 1,
       stdout: out.stdout ?? "",
@@ -27196,49 +27888,22 @@ var defaultCli = (bin, available) => {
     });
   };
 };
-var tryCliTriple = async (cli, args, root, id, idKeys, bodyKeys) => {
+var tryCliTriple = async (cli, name, args, root, id, idKeys, bodyKeys) => {
   if (!cli)
-    return null;
+    return { error: `${name} CLI is unavailable`, kind: "creds" };
   const run = cli(args, root);
   if (!run)
-    return null;
+    return { error: `${name} CLI is unavailable`, kind: "creds" };
   const out = await run;
   if (out.status !== 0)
-    return null;
+    return { error: `${name} CLI is not authenticated or the issue is unavailable`, kind: "creds" };
   try {
-    return parseTriple(JSON.parse(out.stdout), id, idKeys, bodyKeys);
+    const triple = parseTriple(JSON.parse(out.stdout), id, idKeys, bodyKeys);
+    return triple ? { data: triple } : { error: `unexpected ${name} issue response`, kind: "request" };
   } catch {
-    return null;
+    return { error: `invalid ${name} issue response`, kind: "request" };
   }
 };
-var originRemote = (root) => {
-  const out = spawnSync5("git", ["remote", "get-url", "origin"], { cwd: root, encoding: "utf8" });
-  return out.status === 0 ? (out.stdout ?? "").trim() || null : null;
-};
-var trackerCreds = (root, provider) => {
-  const cfg = vcsConfig("load", root);
-  if (!cfg || cfg.provider !== provider || typeof cfg.tokenPath !== "string" || !cfg.tokenPath)
-    return { error: `unconfigured ${provider} provider` };
-  let token = "";
-  try {
-    token = fs9.readFileSync(cfg.tokenPath, "utf8").trim();
-  } catch {
-    return { error: `missing ${provider} token` };
-  }
-  if (!token)
-    return { error: `empty ${provider} token file` };
-  if (provider === "gitlab") {
-    const gitlab = cfg.gitlab;
-    const apiUrl = String(gitlab?.apiUrl ?? "https://gitlab.com/api/v4").replace(/\/+$/, "");
-    return { token, api: apiUrl };
-  }
-  const github = cfg.github;
-  const host = String(github?.host ?? "github.com").toLowerCase();
-  return {
-    token,
-    api: host === "github.com" ? "https://api.github.com" : `https://${host}/api/v3`
-  };
-};
 var parseTriple = (parsed, id, idKeys, bodyKeys) => {
   const title = parsed.title;
   if (typeof title !== "string")
@@ -27261,62 +27926,36 @@ var fetchGitHubIssueBody = async (ref, root, deps = {}) => {
   const id = parseGhIssue(ref);
   if (!/^\d+$/.test(id))
     return { error: `invalid GitHub issue ref "${ref}"`, kind: "input" };
-  const repo = repoPathFromRemote((deps.remote ?? originRemote)(root) ?? "");
+  const remote = (deps.remote ?? pushRemote)(root);
+  const repo = repoPathFromRemote(remote ?? "");
   if (!repo)
     return { error: "no origin remote to resolve the repository", kind: "input" };
-  const viaCli = await tryCliTriple(deps.cli ?? defaultCli("gh", hostingCliAvailable("github")), ["issue", "view", id, "--repo", repo, "--json", "number,title,body,state"], root, id, ["number"], ["body"]);
-  if (viaCli)
-    return { data: viaCli };
-  const credentials = (deps.creds ?? ((r) => trackerCreds(r, "github")))(root);
-  if ("error" in credentials)
-    return { ...credentials, kind: "creds" };
-  const out = await (deps.request ?? trackerRequest)(`${credentials.api}/repos/${repo}/issues/${id}`, {
-    method: "GET",
-    headers: {
-      Authorization: `Bearer ${credentials.token}`,
-      Accept: "application/vnd.github+json"
-    }
-  });
-  if (out.status !== 0)
-    return { error: out.stderr || "GitHub issue fetch failed", kind: "request" };
-  try {
-    const triple = parseTriple(JSON.parse(out.stdout), id, ["number"], ["body"]);
-    if (!triple)
-      return { error: "unexpected GitHub issue shape", kind: "request" };
-    return { data: triple };
-  } catch {
-    return { error: "invalid GitHub issue response", kind: "request" };
-  }
+  const cfg = vcsConfig("load", root);
+  const host = (deps.host ?? (cfg.ok && cfg.provider === "github" ? cfg.github?.host : null) ?? "github.com").toLowerCase();
+  if (!remote || !hostingApiHostMatches(remote, host))
+    return { error: "hosting API host does not match the push destination", kind: "input" };
+  const repoArg = host === "github.com" ? repo : `${host}/${repo}`;
+  return tryCliTriple(deps.cli ?? defaultCli("gh", hostingCliAvailable("github")), "gh", ["issue", "view", id, "--repo", repoArg, "--json", "number,title,body,state"], root, id, ["number"], ["body"]);
 };
 var fetchGitLabIssueBody = async (ref, root, deps = {}) => {
   const id = parseGhIssue(ref);
   if (!/^\d+$/.test(id))
     return { error: `invalid GitLab issue ref "${ref}"`, kind: "input" };
-  const repo = repoPathFromRemote((deps.remote ?? originRemote)(root) ?? "");
+  const remote = (deps.remote ?? pushRemote)(root);
+  const repo = repoPathFromRemote(remote ?? "");
   if (!repo)
     return { error: "no origin remote to resolve the project", kind: "input" };
-  const viaCli = await tryCliTriple(deps.cli ?? defaultCli("glab", hostingCliAvailable("gitlab")), ["issue", "view", id, "-R", repo, "-F", "json"], root, id, ["iid"], ["description"]);
-  if (viaCli)
-    return { data: viaCli };
-  const credentials = (deps.creds ?? ((r) => trackerCreds(r, "gitlab")))(root);
-  if ("error" in credentials)
-    return { ...credentials, kind: "creds" };
-  const out = await (deps.request ?? trackerRequest)(`${credentials.api}/projects/${encodeURIComponent(repo)}/issues/${id}`, { method: "GET", headers: { "PRIVATE-TOKEN": credentials.token } });
-  if (out.status !== 0)
-    return { error: out.stderr || "GitLab issue fetch failed", kind: "request" };
-  try {
-    const triple = parseTriple(JSON.parse(out.stdout), id, ["iid"], ["description"]);
-    if (!triple)
-      return { error: "unexpected GitLab issue shape", kind: "request" };
-    return { data: triple };
-  } catch {
-    return { error: "invalid GitLab issue response", kind: "request" };
-  }
+  const cfg = vcsConfig("load", root);
+  const host = (deps.host ?? (cfg.ok && cfg.provider === "gitlab" ? cfg.gitlab?.host : null) ?? "gitlab.com").toLowerCase();
+  if (!remote || !hostingApiHostMatches(remote, host))
+    return { error: "hosting API host does not match the push destination", kind: "input" };
+  const repoArg = host === "gitlab.com" ? repo : `https://${host}/${repo}`;
+  return tryCliTriple(deps.cli ?? defaultCli("glab", hostingCliAvailable("gitlab")), "glab", ["issue", "view", id, "-R", repoArg, "-F", "json"], root, id, ["iid"], ["description"]);
 };
 
 // packages/workit-core/src/core/youtrack.ts
-import fs10 from "node:fs";
-import path13 from "node:path";
+import fs9 from "node:fs";
+import path14 from "node:path";
 
 // packages/workit-core/src/core/templates.ts
 var repoRoot2 = assetRoot();
@@ -27328,23 +27967,23 @@ var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
-var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path13.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path13.join(resolveConfigDir(), "youtrack.json");
+var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path14.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path14.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
-  const mode = fs10.statSync(p).mode & 511;
+  const mode = fs9.statSync(p).mode & 511;
   return mode === 384;
 };
 function readYouTrackConfig(required) {
   const cfgPath = youTrackConfigPath();
-  if (!fs10.existsSync(cfgPath)) {
+  if (!fs9.existsSync(cfgPath)) {
     return required ? { error: "ERROR: missing youtrack.json", path: cfgPath } : { config: {}, path: cfgPath };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs10.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs9.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: `${cfgPath} is not valid JSON`, path: cfgPath };
   }
@@ -27355,11 +27994,11 @@ function readYouTrackConfig(required) {
 }
 var readYouTrackContextConfig = () => {
   const cfgPath = youTrackReadOnlyConfigPath();
-  if (!fs10.existsSync(cfgPath))
+  if (!fs9.existsSync(cfgPath))
     return { data: {} };
   let parsed;
   try {
-    parsed = JSON.parse(fs10.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs9.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: "YouTrack configuration is unavailable" };
   }
@@ -27384,12 +28023,12 @@ function youTrackGreeting(configOverride) {
   const cfgPath = configOverride ?? youTrackConfigPath();
   let parsed;
   try {
-    parsed = JSON.parse(fs10.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs9.readFileSync(cfgPath, "utf8"));
   } catch {
     return {
       stdout: "",
       exitCode: 1,
-      stderr: fs10.existsSync(cfgPath) ? `${cfgPath} is not valid JSON` : `missing youtrack.json: ${cfgPath}`
+      stderr: fs9.existsSync(cfgPath) ? `${cfgPath} is not valid JSON` : `missing youtrack.json: ${cfgPath}`
     };
   }
   if (!isConfigObject(parsed)) {
@@ -27435,15 +28074,15 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path13.isAbsolute(tokenFile) ? path13.resolve(tokenFile) : path13.resolve(process.cwd(), tokenFile) : "";
-  if (!tokenPath || !fs10.existsSync(tokenPath))
+  const tokenPath = tokenFile ? path14.isAbsolute(tokenFile) ? path14.resolve(tokenFile) : path14.resolve(process.cwd(), tokenFile) : "";
+  if (!tokenPath || !fs9.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
     return { error: "youtrack.token mode must be 0600" };
-  const token = fs10.readFileSync(tokenPath, "utf8").trim();
+  const token = fs9.readFileSync(tokenPath, "utf8").trim();
   if (!token)
     return { error: "empty token file" };
-  if (token === TOKEN_PLACEHOLDER2 || token.startsWith(TOKEN_PLACEHOLDER2)) {
+  if (token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER)) {
     return {
       error: "token file still has placeholder YOUR_TOKEN_HERE — edit the file locally, then run /wk-status"
     };
@@ -27506,9 +28145,9 @@ function resolveYouTrackFromPaths(spec_path, plan_path, workspace_root) {
     } catch {
       continue;
     }
-    if (!fs10.existsSync(full))
+    if (!fs9.existsSync(full))
       continue;
-    const text = fs10.readFileSync(full, "utf8");
+    const text = fs9.readFileSync(full, "utf8");
     const m = text.match(/^\*\*YouTrack:\*\*\s*`?([A-Z]+-\d+)`?/m);
     if (m)
       return m[1];
@@ -27742,6 +28381,7 @@ var readExternalContext = async (root, payload) => {
     }
   }
 };
+var targetWriterActionLease = Symbol("target-writer-action-lease");
 
 // packages/workit-mcp/src/server.ts
 class McpCapabilityUnavailableError extends Error {
@@ -27786,13 +28426,13 @@ var rootVariants = (workspaceRoot) => {
   if (!workspaceRoot)
     return [];
   const roots = new Set;
-  for (const candidate of [workspaceRoot, path14.resolve(workspaceRoot)]) {
-    if (path14.isAbsolute(candidate) && candidate !== path14.parse(candidate).root)
+  for (const candidate of [workspaceRoot, path15.resolve(workspaceRoot)]) {
+    if (path15.isAbsolute(candidate) && candidate !== path15.parse(candidate).root)
       roots.add(candidate);
   }
   try {
-    const canonical = realpathSync7(workspaceRoot);
-    if (canonical !== path14.parse(canonical).root)
+    const canonical = realpathSync8(workspaceRoot);
+    if (canonical !== path15.parse(canonical).root)
       roots.add(canonical);
   } catch {}
   return [...roots].sort((left, right) => right.length - left.length);
@@ -27893,11 +28533,11 @@ var thrownResult = (tool, error, workspaceRoot) => {
 };
 function createMcpServer(host, contextProvider) {
   assertMcpHost(host);
-  const here = path14.dirname(fileURLToPath2(import.meta.url));
+  const here = path15.dirname(fileURLToPath2(import.meta.url));
   const sourceMarker = markSourcesLoaded([
-    path14.join(here, "server.ts"),
-    path14.join(here, "..", "..", "workit-core", "src", "core", "task-contract.ts"),
-    path14.join(here, "..", "..", "workit-core", "src", "core", "task-engine.ts")
+    path15.join(here, "server.ts"),
+    path15.join(here, "..", "..", "workit-core", "src", "core", "task-contract.ts"),
+    path15.join(here, "..", "..", "workit-core", "src", "core", "task-engine.ts")
   ].filter((file) => existsSync7(file)));
   let staleWarned = false;
   const server = new Server({ name: "workit", version: VERSION }, { capabilities: { tools: {}, resources: {} } });
@@ -28178,6 +28818,7 @@ var allowedKeys = {
     "stop_hook_active"
   ])
 };
+var historyOfferSessions = new Set;
 if (false)
   ;
 
@@ -28190,14 +28831,14 @@ var codexQualification = (host) => host === "codex_cli" ? { surface: host, cli:
 var resolveCodexWorkspaceRoot = (pluginRoot, env) => {
   const explicit = env.WORKFLOW_WORKSPACE_ROOT;
   const inherited = env.PWD;
-  const candidate = explicit ?? (inherited && path15.resolve(inherited) !== path15.resolve(pluginRoot) ? inherited : undefined);
-  if (!candidate || !path15.isAbsolute(candidate) || !existsSync8(candidate))
+  const candidate = explicit ?? (inherited && path16.resolve(inherited) !== path16.resolve(pluginRoot) ? inherited : undefined);
+  if (!candidate || !path16.isAbsolute(candidate) || !existsSync8(candidate))
     return null;
   try {
-    if (!statSync2(candidate).isDirectory())
+    if (!statSync3(candidate).isDirectory())
       return null;
-    const canonical = realpathSync8(candidate);
-    if (canonical === realpathSync8(pluginRoot)) {
+    const canonical = realpathSync9(candidate);
+    if (canonical === realpathSync9(pluginRoot)) {
       if (!explicit)
         return null;
       const workspace = new TaskStore(canonical).readWorkspace();