@brainervirus/workit-codex 8.10.0 → 8.12.0

package/dist/{workit-hook-xhqhe7h0.js → workit-hook-yfq6yhse.js}

@@ -91,9 +91,9 @@ Autonomy contract:
   ship), go to the effective endpoint in \`workit grant show\`: \`pr\` opens
   the PR; \`green\` babysits it without asking (workit-ship) to merge-ready,
   never merging; \`merged\` also lands it with \`workit pr merge\`.
-  Merge and release need a workspace grant, which only the user raises from
-  their own terminal (a blocked verb names how); never edit workspaces.json or
-  route around a grant_required.
+  Merge and release need a workspace grant only the user raises from their
+  own terminal (a blocked verb names how); never edit workspaces.json or route
+  around a grant_required.
 - Ask only for a product or preference choice, or for authority you lack, with
   your recommended answer. Facts are yours: read, run or prototype.
 - Label claims measured (run and seen this session), inferred, or guess.
@@ -102,17 +102,19 @@ Autonomy contract:
 - Author is not verifier: your own verdict is \`--self\`, shown as
   self-reviewed, never verified. High risk, \`verification: independent\` and
   merge need a verifier with its own host-derived session (a subagent's
-  \`<lead>:<child>\`, set by the host); never hand-mint one such as \`<lead>-v1\`.
+  \`<lead>:<child>\`); never hand-mint one (\`<lead>-v1\`).
 - A local-commit endpoint does not imply PR readiness, and a local commit alone
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
 
 CLI first: if a step has one right answer, use the \`workit\` verb instead of
 hand-running git, gh or glab (\`workit git|pr|ci|check\`; \`workit help\` lists
-the rest; without \`workit\` on PATH, \`npx -y @brainervirus/workit-cli\`).
+the rest; lacking \`workit\`, \`npx -y @brainervirus/workit-cli\`).
+Add Co-Authored-By via \`workit git commit --trailer "K: v" -- <paths>\`, never
+an amend.
 The task families (task, policy, evidence, finding, decision, worker, state)
 are optional continuity for tracked work; each branch has one implicit task,
-created by the first recording, and a solo edit needs no task. A decision
+and a solo edit needs no task. A decision
 records a user choice; it never authorizes an effect. Judge work once with
 \`workit policy assess --judge risk= behavior= product-choice= plan=\`.
 Across repositories, bind each item to its checkout, branch and endpoint,
@@ -8960,7 +8962,7 @@ function loadCheckConfig(cwd) {
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null };
+  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
 }
 var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
 function matchesNamedCheck(config, name, argv, cwd) {
@@ -12377,6 +12379,7 @@ var branchNames = (workspaceRoot) => {
   return new Set((r.stdout ?? "").split(`
 `).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
 };
+var productionBranchOf = (names) => names.has("main") ? "main" : names.has("master") ? "master" : "main";
 var detectBranchPolicy = (workspaceRoot) => {
   const names = branchNames(workspaceRoot);
   const develop = names.has("develop");
@@ -12505,6 +12508,7 @@ var workspaceConfigSchema = object({
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
   defaultEndpoint: unknown().optional(),
   verification: _enum(["self", "independent"]).optional(),
+  trailers: boolean2().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -12786,8 +12790,8 @@ var resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd,
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
-var matchRuntimeWorkspace = (cwd) => {
-  const file = path11.join(configDir(), "workspaces.json");
+var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
+  const file = path11.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -12816,12 +12820,30 @@ var matchRuntimeWorkspace = (cwd) => {
   const matches = matchingEntries(cwd, entries ?? []);
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  return selected ? { file, selected } : null;
+  return selected ? { file, selected, matches } : null;
 };
 var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
 };
+var workspaceTrailers = (cwd, dir) => {
+  let matched;
+  try {
+    matched = matchRuntimeWorkspace(cwd, dir);
+  } catch {
+    return { enabled: true, workspace: null, from: null };
+  }
+  if (!matched)
+    return { enabled: true, workspace: null, from: null };
+  const { selected, matches } = matched;
+  const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return {
+    enabled: source?.trailers !== false,
+    workspace: selected.name,
+    from: source?.name ?? null
+  };
+};
 var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   const matched = matchRuntimeWorkspace(cwd);
   if (!matched)
@@ -17664,6 +17686,18 @@ var seedTurnContext = (input, descriptor, text = turnContextText(input, descript
   else
     clearTurnDigest(file);
 };
+// packages/workit-core/src/core/route-intent.ts
+import { spawnSync as spawnSync12 } from "node:child_process";
+import { existsSync as existsSync6 } from "node:fs";
+import path20 from "node:path";
+
+// packages/workit-core/src/hooks/raw-git.ts
+import { spawnSync as spawnSync11 } from "node:child_process";
+import { createHash as createHash14 } from "node:crypto";
+import fs16 from "node:fs";
+import os4 from "node:os";
+import path19 from "node:path";
+
 // packages/workit-core/src/core/branch.ts
 import { createHash as createHash12 } from "node:crypto";
 var withReleaseTracks = (workspaceRoot, policy) => {
@@ -17701,10 +17735,72 @@ function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
     provenance: { commitPolicy: selected.source }
   };
 }
+var KIND_SYNONYMS = {
+  fix: "bugfix",
+  fixes: "bugfix",
+  bug: "bugfix",
+  bugs: "bugfix",
+  bugfixes: "bugfix",
+  feat: "feature",
+  features: "feature",
+  chore: "feature",
+  docs: "feature",
+  doc: "feature",
+  refactor: "feature",
+  test: "feature",
+  tests: "feature",
+  ci: "feature",
+  build: "feature",
+  perf: "feature",
+  style: "feature",
+  deps: "feature",
+  task: "feature",
+  enhancement: "feature",
+  hot: "hotfix",
+  hotfixes: "hotfix",
+  releases: "release",
+  rel: "release"
+};
+var allowedKinds = (allowed) => [
+  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
+];
+var editDistance = (a, b) => {
+  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (let i = 1;i <= a.length; i++) {
+    let previous = row[0];
+    row[0] = i;
+    for (let j = 1;j <= b.length; j++) {
+      const saved = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+      previous = saved;
+    }
+  }
+  return row[b.length];
+};
+var suggestBranchName = (name, kinds) => {
+  if (!kinds.length)
+    return null;
+  const slash = name.indexOf("/");
+  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
+  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
+  const synonym = KIND_SYNONYMS[prefix];
+  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
+  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
+  return `${kind}/${rest}`;
+};
+var kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", ");
+var aliasNote = (kinds) => {
+  const notes = [
+    ["fix", "bugfix"],
+    ["chore", "feature"]
+  ].filter(([, kind]) => kinds.includes(kind)).map(([alias, kind]) => `${alias}/ is ${kind}/`);
+  return notes.length ? ` (${notes.join(", ")})` : "";
+};
 var validateBranchNamePolicy = (name, policy, source) => {
   const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
+  const kinds = allowedKinds(policy.allowed);
   if (policy.protected.has(name.toLowerCase())) {
-    const correction = `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
+    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
     return {
       ok: false,
       rule: "protected_ref",
@@ -17715,7 +17811,8 @@ var validateBranchNamePolicy = (name, policy, source) => {
     };
   }
   if (!policy.allowed.some((pattern) => pattern.test(name))) {
-    const correction = `choose a branch matching one of: ${allowed.join(", ")}`;
+    const suggestion = suggestBranchName(name, kinds);
+    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
     return {
       ok: false,
       rule: "allowed_pattern",
@@ -17758,31 +17855,87 @@ var validateBranchNameFor = (workspaceRoot, name) => {
   }
 };
 var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
-
-// packages/workit-core/src/core/route-intent.ts
-var shellBranchTarget = (command) => {
-  if (!command.trim() || /[\r\n;&|<>`'"$()\\*?{}~!#]/u.test(command) || command.includes("[") || command.includes("]"))
-    return null;
-  const args = command.trim().split(/\s+/u);
-  if (args[0] !== "git")
+var gitFlowOf = (root, integration) => {
+  try {
+    if (resolveBranchPolicyFor(root).preset !== "gitflow")
+      return null;
+    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    const names = branchNames(root);
+    const production = productionBranchOf(names);
+    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
+    return { develop, production, developExists: names.has(develop) };
+  } catch {
     return null;
-  const option = args[2];
-  const target = args[1] === "switch" && ["-c", "--create", "-C", "--force-create"].includes(option ?? "") && (args.length === 4 || args.length === 5) ? args[3] : args[1] === "checkout" && ["-b", "-B"].includes(option ?? "") && (args.length === 4 || args.length === 5) ? args[3] : args[1] === "branch" && (args.length === 3 || args.length === 4) ? args[2] : null;
-  return target && !target.startsWith("-") ? target : null;
+  }
 };
-var shellBranchPolicyViolation = (root, command) => {
-  const target = shellBranchTarget(command);
-  return target === null ? null : validateBranchNameFor(root, target);
+var releaseBranchesOf = (cwd) => {
+  try {
+    const resolved = resolveBranchPolicyFor(cwd);
+    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
+    return {
+      preset: resolved.preset,
+      branches: flow ? [flow.production, flow.develop] : [],
+      production: flow ? flow.production : resolved.defaultTargetBranch
+    };
+  } catch {
+    return { preset: "unknown", branches: [], production: null };
+  }
 };
-
-// packages/workit-core/src/hooks/policy.ts
-var shellPolicy = (cwd, command) => {
-  const policy = shellBranchPolicyViolation(cwd, command);
-  return policy && !policy.ok ? { kind: "deny", reason: `branch_policy_denied: ${policy.error}`, unblock: null } : { kind: "none" };
+var releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase());
+var branchGuidance = (cwd) => {
+  try {
+    const patterns = branchPolicySnapshotFor(cwd).namePolicy.allowed;
+    const kinds = allowedKinds(patterns);
+    const kindShaped = new Set(kinds.map((kind) => branchGlobPattern(`${kind}/*`).source));
+    const anyName = patterns.some((pattern) => pattern.source === "^.*$");
+    const others = patterns.filter((pattern) => !kindShaped.has(pattern.source)).map((pattern) => globOf(pattern));
+    const allowed = anyName ? "Any non-protected branch name is allowed here." : `${kinds.length ? `Allowed branch kinds here: ${kindList(kinds)}${aliasNote(kinds)}` : "Allowed branch names here:"}${others.length ? `${kinds.length ? "; also" : ""} names matching ${others.join(", ")}` : ""}; anything else is denied.`;
+    const resolved = vcsConfig("resolve", cwd);
+    const integration = resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
+    const flow = resolved.releaseTrack?.track ? null : gitFlowOf(cwd, integration);
+    if (flow?.developExists)
+      return `${allowed} git-flow: feature/, bugfix/ and release/ start from origin/${flow.develop}, hotfix/ from origin/${flow.production}; feature/ and bugfix/ land on ${flow.develop}, release/ and hotfix/ on ${flow.production}.`;
+    const names = branchNames(cwd);
+    const configured = String(resolved.baseBranch ?? integration ?? "") || null;
+    const trunk = productionBranchOf(names);
+    const base = configured && names.has(configured) ? `Branch from origin/${configured}.` : names.has(trunk) ? `Branch from origin/${trunk}${configured ? ` (the default target ${configured} does not exist here)` : ""}.` : "No base branch exists here yet; pass the base explicitly.";
+    return `${allowed} ${base}`;
+  } catch {
+    return null;
+  }
 };
-// packages/workit-core/src/hooks/write-gate.ts
-import { realpathSync as realpathSync5 } from "node:fs";
+var globOf = (pattern) => pattern.source.replace(/^\^|\$$/gu, "").replaceAll(".*", "*").replace(/\\(.)/gu, "$1");
+
+// packages/workit-core/src/hooks/session-marker.ts
+import { createHash as createHash13 } from "node:crypto";
+import fs15 from "node:fs";
 import path18 from "node:path";
+var sessionMarkerFile = (input, session, store) => {
+  let dir = store;
+  if (dir === undefined) {
+    const location = resolveStore(input.cwd);
+    if (location instanceof Error || !location.shared)
+      return null;
+    dir = location.dir;
+  }
+  const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
+  return path18.join(dir, "hooks", `skills-${name}.json`);
+};
+var list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+var readSessionMarker = (file) => {
+  try {
+    const value = JSON.parse(fs15.readFileSync(file, "utf8"));
+    return { nudged: list2(value.nudged), loaded: list2(value.loaded), raw: list2(value.raw) };
+  } catch {
+    return { nudged: [], loaded: [], raw: [] };
+  }
+};
+var writeSessionMarker = (file, marker) => {
+  try {
+    fs15.mkdirSync(path18.dirname(file), { recursive: true });
+    fs15.writeFileSync(file, JSON.stringify(marker));
+  } catch {}
+};
 
 // packages/workit-core/src/hooks/shell-words.ts
 var closingQuote = (command, start, dialect) => {
@@ -17907,301 +18060,87 @@ var segmentsOf = (command, dialect = "posix") => {
   return segments;
 };
 
-// packages/workit-core/src/hooks/write-gate.ts
+// packages/workit-core/src/hooks/raw-git.ts
 var NONE2 = { kind: "none" };
-var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
-var canonical2 = (file) => {
-  let rest = "";
-  for (let dir = path18.resolve(file);; dir = path18.dirname(dir)) {
-    try {
-      return path18.join(realpathSync5(dir), rest);
-    } catch {
-      if (path18.dirname(dir) === dir)
-        return path18.resolve(file);
-      rest = rest ? path18.join(path18.basename(dir), rest) : path18.basename(dir);
-    }
-  }
+var SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "nice", "&"]);
+var SCRIPT_FLAG = /^-[a-zA-Z]*c[a-zA-Z]*$/;
+var CD = new Set(["cd", "chdir", "set-location", "sl"]);
+var PUSHD = new Set(["pushd", "push-location"]);
+var POPD = new Set(["popd", "pop-location"]);
+var GIT_VALUE_OPTIONS = new Set([
+  "-c",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--exec-path",
+  "--config-env",
+  "--super-prefix"
+]);
+var isAbsolute = (value) => path19.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
+var joinDir = (base, next) => {
+  if (base === undefined || /[$`*?]/.test(next) || next === "-")
+    return;
+  const expanded = next === "~" || next.startsWith("~/") ? path19.join(os4.homedir(), next.slice(1)) : next;
+  return base === null || isAbsolute(expanded) ? expanded : path19.join(base, expanded);
 };
-var exempt = (cwd, root, file, plans) => {
-  const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path18.relative(fold(canonical2(root)), fold(canonical2(path18.resolve(cwd, file))));
-  if (relative.startsWith("..") || path18.isAbsolute(relative))
-    return true;
-  const posix = relative.split(path18.sep).join("/");
-  const segments = posix.split("/");
-  return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
+var cdTarget = (words) => {
+  const args = words.slice(1);
+  const flag = args.findIndex((word) => /^-(?:literal)?path$/i.test(word));
+  if (flag >= 0)
+    return args[flag + 1] ?? null;
+  return args.find((word) => word === "-" || !word.startsWith("-")) ?? null;
 };
-var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
-var operands = (words) => words.filter((item) => !item.startsWith("-"));
-var editsOf = (input) => {
+var stripPrefixes = (input) => {
   let words = input;
-  while (words.length && (PREFIXES2.has(words[0]) || /^\w+=/.test(words[0])))
-    words = words.slice(1);
-  const [verb, ...args] = words;
-  const name = (verb?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
-  if (!name || name === "workit" || name === "npx" && args.some((item) => /workit/.test(item)))
-    return [];
-  switch (name) {
-    case "touch":
-    case "mkdir":
-    case "rm":
-    case "rmdir":
-    case "tee":
-    case "mv":
-    case "truncate":
-      return operands(args);
-    case "cp":
-    case "ln":
-    case "install": {
-      const target = args.indexOf("-t");
-      if (target >= 0)
-        return args[target + 1] ? [args[target + 1]] : null;
-      const last = operands(args).at(-1);
-      return last ? [last] : null;
+  for (;; ) {
+    const first = words[0];
+    if (first === undefined)
+      return words;
+    if (/^\w+=/.test(first))
+      words = words.slice(1);
+    else if (PREFIXES2.has(first)) {
+      words = words.slice(1);
+      while (words[0]?.startsWith("-"))
+        words = words.slice(words[0] === "-u" ? 2 : 1);
+    } else if (first === "timeout") {
+      words = words.slice(1);
+      while (words[0]?.startsWith("-"))
+        words = words.slice(1);
+      words = words.slice(1);
+    } else
+      return words;
+  }
+};
+var commandName = (word) => (word?.split(/[\\/]/).at(-1) ?? "").toLowerCase().replace(/\.exe$/, "");
+function rawInvocations(command, dialect = "posix", depth = 0) {
+  const found = [];
+  let dir = null;
+  const groups = [];
+  let stack = [];
+  for (const segment of segmentsOf(command, dialect)) {
+    if (segment.group === "open") {
+      groups.push({ dir, stack: [...stack] });
+      continue;
     }
-    case "dd":
-      return args.filter((item) => item.startsWith("of=")).map((item) => item.slice(3));
-    case "sed":
-    case "perl": {
-      if (!args.some((item) => /^-[a-zA-Z]*i|^--in-place/.test(item)))
-        return [];
-      const scripted = args.some((item) => item === "-e" || item === "-f");
-      const files = [];
-      for (let index = 0;index < args.length; index++) {
-        if (args[index] === "-e" || args[index] === "-f")
-          index++;
-        else if (!args[index].startsWith("-"))
-          files.push(args[index]);
-      }
-      return scripted ? files : files.slice(1);
+    if (segment.group === "close") {
+      const saved = groups.pop();
+      if (saved)
+        ({ dir, stack } = saved);
+      continue;
     }
-    case "patch":
-      return null;
-    case "set-content":
-    case "add-content":
-    case "out-file":
-    case "new-item":
-    case "ni":
-    case "remove-item":
-    case "del":
-    case "copy-item":
-    case "move-item": {
-      const flag = args.findIndex((item) => /^-(?:path|filepath|literalpath|destination)$/i.test(item));
-      if (flag >= 0)
-        return args[flag + 1] ? [args[flag + 1]] : null;
-      const files = operands(args);
-      if (name === "move-item")
-        return files.length ? files : null;
-      const file = name === "copy-item" ? files.at(-1) : files[0];
-      return file ? [file] : null;
+    const words = stripPrefixes(segment.words);
+    const name = commandName(words[0]);
+    if (CD.has(name)) {
+      const target = cdTarget(words);
+      dir = target === null ? os4.homedir() : joinDir(dir, target);
+      continue;
     }
-    case "git": {
-      const sub = operands(args)[0];
-      if (sub === "apply")
-        return null;
-      if (sub === "restore" || sub === "mv" || sub === "rm")
-        return operands(args).slice(1);
-      if (sub === "checkout" && args.includes("--"))
-        return args.slice(args.indexOf("--") + 1);
-      return [];
-    }
-    default:
-      return [];
-  }
-};
-var shellWrites = (command) => {
-  const targets = [];
-  let unknown = false;
-  for (const segment of segmentsOf(command)) {
-    targets.push(...segment.redirects.filter((item) => !/^\/dev\/(?:null|stdout|stderr|tty)$/.test(item)));
-    const edits = editsOf(segment.words);
-    if (edits === null)
-      unknown = true;
-    else
-      targets.push(...edits);
-  }
-  if (!unknown && targets.length === 0)
-    return { writes: false, targets: null };
-  return { writes: true, targets: unknown ? null : targets };
-};
-var cache2 = new Map;
-var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path18.resolve(root, file)) ?? "-").join("\x00");
-var gateFor = (cwd) => {
-  const store = new TaskStore(cwd);
-  const listed = store.listTaskIndex();
-  if (!listed.ok)
-    return null;
-  const key = store.currentKey();
-  if (!key.ok)
-    return null;
-  const entry = listed.data.filter((item) => item.key === key.data.key && item.status !== "closed").toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
-  if (!entry)
-    return { blockers: [], root: store.root, plans: new Set };
-  const ledger = ledgerPath(store.root);
-  const cacheKey = `${entry.id}\x00${entry.revision}\x00${ledger.ok && fileSignature(ledger.value) || "-"}`;
-  const hit = cache2.get(store.root);
-  if (hit && hit.key === cacheKey && hit.planKey === planKeyOf(store.root, hit.plans))
-    return hit;
-  const task = store.readTask(entry.id);
-  if (!task.ok)
-    return null;
-  const workspace = store.readWorkspace();
-  const plans = new Set((latestJudgment(task.data)?.refs ?? []).flatMap((ref) => ref.kind === "file" ? [ref.path] : []));
-  const blockers = writeBlockers(task.data, store.root).filter((blocker) => {
-    const requirement = task.data.policy?.requirements.find((item) => item.ruleId === blocker.ruleId && item.before === "write");
-    return !(requirement?.acceptanceAllowed && workspace.ok && workspace.data && applicableDecision(task.data, workspace.data, requirement, store.root).length > 0);
-  });
-  const gate = {
-    blockers,
-    root: store.root,
-    plans,
-    key: cacheKey,
-    planKey: planKeyOf(store.root, plans)
-  };
-  cache2.set(store.root, gate);
-  if (cache2.size > 32)
-    cache2.delete(cache2.keys().next().value);
-  return gate;
-};
-function writeGate(cwd, paths) {
-  try {
-    const gate = gateFor(cwd);
-    if (!gate || gate.blockers.length === 0)
-      return NONE2;
-    if (paths?.length && paths.every((file) => exempt(cwd, gate.root, file, gate.plans)))
-      return NONE2;
-    const reasons = gate.blockers.map((item) => `${item.ruleId}: ${item.reason}`).join("; ");
-    return {
-      kind: "deny",
-      reason: `workit before-write gate: ${reasons}. Markdown, docs/, plans/ and files outside the checkout stay writable.`,
-      unblock: gate.blockers[0].reason
-    };
-  } catch {
-    return NONE2;
-  }
-}
-// packages/workit-core/src/hooks/stop.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
-
-// packages/workit-core/src/hooks/raw-git.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
-import { createHash as createHash14 } from "node:crypto";
-import fs16 from "node:fs";
-import os4 from "node:os";
-import path20 from "node:path";
-
-// packages/workit-core/src/hooks/session-marker.ts
-import { createHash as createHash13 } from "node:crypto";
-import fs15 from "node:fs";
-import path19 from "node:path";
-var sessionMarkerFile = (input, session, store) => {
-  let dir = store;
-  if (dir === undefined) {
-    const location = resolveStore(input.cwd);
-    if (location instanceof Error || !location.shared)
-      return null;
-    dir = location.dir;
-  }
-  const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
-  return path19.join(dir, "hooks", `skills-${name}.json`);
-};
-var list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-var readSessionMarker = (file) => {
-  try {
-    const value = JSON.parse(fs15.readFileSync(file, "utf8"));
-    return { nudged: list2(value.nudged), loaded: list2(value.loaded), raw: list2(value.raw) };
-  } catch {
-    return { nudged: [], loaded: [], raw: [] };
-  }
-};
-var writeSessionMarker = (file, marker) => {
-  try {
-    fs15.mkdirSync(path19.dirname(file), { recursive: true });
-    fs15.writeFileSync(file, JSON.stringify(marker));
-  } catch {}
-};
-
-// packages/workit-core/src/hooks/raw-git.ts
-var NONE3 = { kind: "none" };
-var SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
-var PREFIXES3 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "nice", "&"]);
-var SCRIPT_FLAG = /^-[a-zA-Z]*c[a-zA-Z]*$/;
-var CD = new Set(["cd", "chdir", "set-location", "sl"]);
-var PUSHD = new Set(["pushd", "push-location"]);
-var POPD = new Set(["popd", "pop-location"]);
-var GIT_VALUE_OPTIONS = new Set([
-  "-c",
-  "--git-dir",
-  "--work-tree",
-  "--namespace",
-  "--exec-path",
-  "--config-env",
-  "--super-prefix"
-]);
-var isAbsolute = (value) => path20.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
-var joinDir = (base, next) => {
-  if (base === undefined || /[$`*?]/.test(next) || next === "-")
-    return;
-  const expanded = next === "~" || next.startsWith("~/") ? path20.join(os4.homedir(), next.slice(1)) : next;
-  return base === null || isAbsolute(expanded) ? expanded : path20.join(base, expanded);
-};
-var cdTarget = (words) => {
-  const args = words.slice(1);
-  const flag = args.findIndex((word) => /^-(?:literal)?path$/i.test(word));
-  if (flag >= 0)
-    return args[flag + 1] ?? null;
-  return args.find((word) => word === "-" || !word.startsWith("-")) ?? null;
-};
-var stripPrefixes = (input) => {
-  let words = input;
-  for (;; ) {
-    const first = words[0];
-    if (first === undefined)
-      return words;
-    if (/^\w+=/.test(first))
-      words = words.slice(1);
-    else if (PREFIXES3.has(first)) {
-      words = words.slice(1);
-      while (words[0]?.startsWith("-"))
-        words = words.slice(words[0] === "-u" ? 2 : 1);
-    } else if (first === "timeout") {
-      words = words.slice(1);
-      while (words[0]?.startsWith("-"))
-        words = words.slice(1);
-      words = words.slice(1);
-    } else
-      return words;
-  }
-};
-var commandName = (word) => (word?.split(/[\\/]/).at(-1) ?? "").toLowerCase().replace(/\.exe$/, "");
-function rawInvocations(command, dialect = "posix", depth = 0) {
-  const found = [];
-  let dir = null;
-  const groups = [];
-  let stack = [];
-  for (const segment of segmentsOf(command, dialect)) {
-    if (segment.group === "open") {
-      groups.push({ dir, stack: [...stack] });
-      continue;
-    }
-    if (segment.group === "close") {
-      const saved = groups.pop();
-      if (saved)
-        ({ dir, stack } = saved);
-      continue;
-    }
-    const words = stripPrefixes(segment.words);
-    const name = commandName(words[0]);
-    if (CD.has(name)) {
-      const target = cdTarget(words);
-      dir = target === null ? os4.homedir() : joinDir(dir, target);
-      continue;
-    }
-    if (PUSHD.has(name)) {
-      const target = cdTarget(words);
-      stack.push(dir);
-      dir = target === null || target === "-" ? undefined : joinDir(dir, target);
-      continue;
+    if (PUSHD.has(name)) {
+      const target = cdTarget(words);
+      stack.push(dir);
+      dir = target === null || target === "-" ? undefined : joinDir(dir, target);
+      continue;
     }
     if (POPD.has(name)) {
       dir = stack.length ? stack.pop() : undefined;
@@ -18275,6 +18214,10 @@ var pushAction = (args) => {
   let force = false;
   let lease = false;
   let wholesale = false;
+  let allTags = false;
+  let deletes = false;
+  let allBranches = false;
+  let mirror = false;
   let remote = null;
   const positionals = [];
   for (let index = 1;index < args.length; index++) {
@@ -18295,14 +18238,22 @@ var pushAction = (args) => {
       force = true;
     else if (arg.startsWith("--force-with-lease") || arg === "--force-if-includes")
       lease = true;
-    else if (["--all", "--mirror", "--branches", "--tags"].includes(arg))
-      wholesale = true;
+    else if (arg === "--delete" || arg === "-d")
+      deletes = true;
+    else if (arg === "--tags")
+      allTags = wholesale = true;
+    else if (arg === "--all" || arg === "--branches")
+      allBranches = wholesale = true;
+    else if (arg === "--mirror")
+      mirror = wholesale = true;
     else if (!arg.startsWith("-"))
       positionals.push(arg);
   }
   const specs = remote === null ? positionals.slice(1) : positionals;
   remote ??= positionals[0] ?? null;
   const targets = [];
+  const tags = [];
+  const deleted = [];
   for (const raw of specs) {
     if (raw.startsWith("+"))
       force = true;
@@ -18311,16 +18262,29 @@ var pushAction = (args) => {
     const destination = colon >= 0 ? spec.slice(colon + 1) : spec;
     if (!destination)
       continue;
-    if (destination === "HEAD")
-      targets.push(null);
-    else if (destination.startsWith("refs/heads/"))
-      targets.push(destination.slice(11));
-    else if (!destination.startsWith("refs/"))
-      targets.push(destination);
+    const name = destination === "HEAD" ? null : destination.startsWith("refs/heads/") ? destination.slice(11) : destination.startsWith("refs/") ? undefined : destination;
+    if (destination.startsWith("refs/tags/"))
+      tags.push(destination.slice(10));
+    if (name === undefined)
+      continue;
+    targets.push(name);
+    if (colon === 0 && name !== null)
+      deleted.push(name);
   }
   if (specs.length === 0 && !wholesale)
     targets.push(null);
-  return { kind: "push", targets, blindForce: force && !lease, remote };
+  return {
+    kind: "push",
+    targets,
+    blindForce: force && !lease,
+    remote,
+    ...tags.length ? { tags } : {},
+    ...allTags ? { allTags: true } : {},
+    ...deletes ? { deletes: true } : {},
+    ...deleted.length ? { deleted } : {},
+    ...allBranches ? { allBranches: true } : {},
+    ...mirror ? { mirror: true } : {}
+  };
 };
 var VALUE_OPTIONS = {
   git: new Set([
@@ -18427,28 +18391,80 @@ var headSha2 = (repo) => {
   if (!git || git.reftable)
     return null;
   try {
-    const head = fs16.readFileSync(path20.join(git.gitDir, "HEAD"), "utf8").trim();
+    const head = fs16.readFileSync(path19.join(git.gitDir, "HEAD"), "utf8").trim();
     if (/^[0-9a-f]{40,64}$/.test(head))
       return head;
     const ref = /^ref: (refs\/.+)$/.exec(head)?.[1];
     if (!ref)
       return null;
-    const common = path20.dirname(repo.location.dir);
+    const common = path19.dirname(repo.location.dir);
     try {
-      return fs16.readFileSync(path20.join(common, ref), "utf8").trim() || null;
+      return fs16.readFileSync(path19.join(common, ref), "utf8").trim() || null;
     } catch {}
-    const packed = fs16.readFileSync(path20.join(common, "packed-refs"), "utf8");
+    const packed = fs16.readFileSync(path19.join(common, "packed-refs"), "utf8");
     return new RegExp(`^([0-9a-f]{40,64}) ${ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m").exec(packed)?.[1] ?? null;
   } catch {
     return null;
   }
 };
 var quote = (text) => `\`${text}\``;
-var refusal = (action, branch) => {
+var refusal = (action, branch, dir) => {
   if (action.kind === "merge")
     return `workit: raw ${quote(action.forge === "gh" ? "gh pr merge" : "glab mr merge")} bypasses the merge grant and the verdict gate. Run ${quote("workit pr merge")} instead (it checks both; ${quote("workit help pr")}).`;
+  const plainPush = action.kind === "push" && !action.blindForce && !action.deletes;
+  if (dir && branch && plainPush && releaseBranch(dir, branch))
+    return `workit: raw ${quote("git push")} onto ${branch}, a protected release branch, bypasses workit's protected-branch check. To finish a release or hotfix, push it with ${quote(`workit git push --release ${branch} [--release v<version>]`)}: it pushes ${branch} (fast-forward only) and the release tag, verifies the remote and records it, under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}). Feature work goes through ${quote("workit git push")} and ${quote("workit pr merge")}.`;
   return `workit: raw ${quote("git push")}${action.kind === "push" && action.blindForce ? " --force" : ""} onto ${branch}, a protected branch or the default target, bypasses workit's protected-branch check. Push your feature branch with ${quote("workit git push")} (${quote("workit git push --force-with-lease")} to rewrite it) and land it with ${quote("workit pr merge")}.`;
 };
+var refFacts = (repo, remote) => {
+  const facts = { heads: new Set, tags: new Set, remoteHeads: new Set };
+  const listed = spawnSync11("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/tags", `refs/remotes/${remote}`], { cwd: repo.dir, encoding: "utf8", timeout: 5000 });
+  const remotePrefix = `refs/remotes/${remote}/`;
+  for (const ref of (listed.stdout ?? "").split(`
+`)) {
+    if (ref.startsWith("refs/heads/"))
+      facts.heads.add(ref.slice(11));
+    else if (ref.startsWith("refs/tags/"))
+      facts.tags.add(ref.slice(10));
+    else if (ref.startsWith(remotePrefix))
+      facts.remoteHeads.add(ref.slice(remotePrefix.length));
+  }
+  return facts;
+};
+var isTag = (facts, name) => facts.tags.has(name) && !facts.heads.has(name);
+var tagRefusal = (action, facts) => {
+  const tags = [
+    ...action.tags ?? [],
+    ...action.targets.filter((name) => name !== null && isTag(facts, name))
+  ];
+  if (!tags.length && !action.allTags)
+    return null;
+  const named = tags.length ? tags.join(" --release ") : "v<version>";
+  return `workit: raw ${quote(`git push${action.allTags ? " --tags" : ""}`)} of ${tags.length ? `tag ${tags.join(", ")}` : "tags"} bypasses the release grant. Push a release tag with ${quote(`workit git push --release ${named}`)} (v<version> tags whose commit the production branch already has; a tag never moves), under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}).`;
+};
+var remoteHas = (repo, remote, branch) => {
+  const listed = spawnSync11("git", ["ls-remote", "--heads", remote, `refs/heads/${branch}`], {
+    cwd: repo.dir,
+    encoding: "utf8",
+    timeout: 3000,
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+  return listed.status !== 0 || (listed.stdout ?? "").trim() !== "";
+};
+var offPolicyPush = (action, repo, facts, remote) => {
+  const names = action.allBranches ? [...facts.heads] : action.targets.map((target) => target ?? repo.branch);
+  for (const branch of names) {
+    if (!branch || action.deleted?.includes(branch) || isTag(facts, branch))
+      continue;
+    if (facts.remoteHeads.has(branch))
+      continue;
+    const check = validateBranchNameFor(repo.dir, branch);
+    if (check.ok || check.rule !== "allowed_pattern" || remoteHas(repo, remote, branch))
+      continue;
+    return `workit: raw ${quote("git push")} onto ${branch}: ${check.error}`;
+  }
+  return null;
+};
 var nudgeFor = (action, host, session) => {
   switch (action.kind) {
     case "commit": {
@@ -18474,7 +18490,7 @@ var actionsIn = (cwd, command, dialect) => {
     const action = rawAction(invocation);
     if (!action)
       continue;
-    const dir = path20.resolve(cwd, invocation.dir ?? ".");
+    const dir = path19.resolve(cwd, invocation.dir ?? ".");
     if (!repos.has(dir)) {
       const repo = repoAt(dir);
       repos.set(dir, repo && isWorkitWorkspace(repo) ? repo : null);
@@ -18511,7 +18527,7 @@ var unseenNudges = (input, nudges, store) => {
 function rawGitPre(input, command, options = {}) {
   try {
     if (!mentionsRawTool(command))
-      return NONE3;
+      return NONE2;
     const dialect = dialectOf(input);
     const nudges = new Map;
     let store = null;
@@ -18519,31 +18535,42 @@ function rawGitPre(input, command, options = {}) {
       store ??= repo.location.dir;
       if (action.kind === "merge")
         return deny(refusal(action, null));
-      if (action.kind === "push")
+      if (action.kind === "push" && toPushRemote(repo, action.remote)) {
+        if (action.mirror)
+          return deny(`workit: raw ${quote("git push --mirror")} rewrites and deletes every remote ref, protected branches and tags included. Push one branch with ${quote("workit git push")}.`);
         for (const target of action.targets) {
           const branch = target ?? repo.branch;
-          if (branch && guardedBranch(repo.dir, branch) && toPushRemote(repo, action.remote))
-            return deny(refusal(action, branch));
+          if (branch && guardedBranch(repo.dir, branch))
+            return deny(refusal(action, branch, repo.dir));
         }
+        const remote = action.remote ?? pushRemoteName(repo.dir, repo.branch) ?? "origin";
+        const facts = refFacts(repo, remote);
+        const tagDeny = tagRefusal(action, facts);
+        if (tagDeny)
+          return deny(tagDeny);
+        const nameDeny = action.deletes ? null : offPolicyPush(action, repo, facts, remote);
+        if (nameDeny)
+          return deny(nameDeny);
+      }
       const nudge = nudgeFor(action, input.host, input.session.id);
       if (nudge && !nudges.has(nudgeKind(action)))
         nudges.set(nudgeKind(action), nudge);
     }
     if (options.nudge === false || !store || nudges.size === 0)
-      return NONE3;
+      return NONE2;
     if (workitInvocations(command, dialect).length > 0)
-      return NONE3;
+      return NONE2;
     const shown = unseenNudges(input, nudges, store);
     return shown.length ? { kind: "context", text: shown.join(`
-`) } : NONE3;
+`) } : NONE2;
   } catch {
-    return NONE3;
+    return NONE2;
   }
 }
 var deny = (reason) => ({ kind: "deny", reason, unblock: null });
 var NEXT_COMMAND = "next";
 var MARKER_TTL_SECONDS = 3600;
-var markerFile = (repo, session, key) => path20.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
+var markerFile = (repo, session, key) => path19.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
 var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash14("sha256").update(command).digest("hex")}`;
 function noteRawCommit(input, command, key) {
   try {
@@ -18554,7 +18581,7 @@ function noteRawCommit(input, command, key) {
       if (action.kind !== "commit")
         continue;
       const file = markerFile(repo, input.session.id, key);
-      fs16.mkdirSync(path20.dirname(file), { recursive: true });
+      fs16.mkdirSync(path19.dirname(file), { recursive: true });
       fs16.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
 `);
     }
@@ -18636,7 +18663,292 @@ function settlePendingCommit(input) {
   } catch {}
 }
 
+// packages/workit-core/src/core/route-intent.ts
+var UNKNOWABLE = /[$`*?[\]{}~]/u;
+var SWITCH_CREATE = new Set(["-c", "--create", "-C", "--force-create", "--orphan"]);
+var CHECKOUT_CREATE = new Set(["-b", "-B", "--orphan"]);
+var WORKTREE_CREATE = new Set(["-b", "-B"]);
+var BRANCH_NO_CREATE = new Set(["-d", "-D", "--delete", "-l", "--list", "-a", "--all", "-r", "--remotes", "--show-current"].concat(["-v", "-vv", "--verbose", "--contains", "--no-contains", "--merged", "--no-merged"]).concat(["--points-at", "--sort", "--format", "--column", "--no-column", "-u"]).concat(["--set-upstream-to", "--unset-upstream", "--edit-description", "-i", "--ignore-case"]));
+var BRANCH_RENAME = new Set(["-m", "-M", "--move", "-c", "-C", "--copy"]);
+var flagValue = (args, flags) => {
+  for (let index = 1;index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--")
+      return null;
+    if (flags.has(arg))
+      return args[index + 1] ?? null;
+    const eq = arg.indexOf("=");
+    if (arg.startsWith("--") && eq > 0 && flags.has(arg.slice(0, eq)))
+      return arg.slice(eq + 1);
+    if (!arg.startsWith("--") && arg.length > 2 && flags.has(arg.slice(0, 2)))
+      return arg.slice(2);
+  }
+  return null;
+};
+var WORKTREE_VALUES = new Set(["--reason"]);
+var worktreeTarget = (args) => {
+  const named = flagValue(args, WORKTREE_CREATE);
+  if (named !== null)
+    return named;
+  const positionals = [];
+  for (let index = 1;index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--detach" || arg === "-d")
+      return null;
+    if (WORKTREE_VALUES.has(arg))
+      index++;
+    else if (!arg.startsWith("-"))
+      positionals.push(arg);
+  }
+  if (positionals.length !== 1)
+    return null;
+  const base = positionals[0].split(/[\\/]/u).findLast(Boolean) ?? "";
+  return base && base !== "." && base !== ".." ? base : null;
+};
+var branchCommandTarget = (args) => {
+  let rename = false;
+  const positionals = [];
+  for (let index = 1;index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--") {
+      positionals.push(...args.slice(index + 1));
+      break;
+    }
+    const flag = arg.split("=", 1)[0];
+    if (BRANCH_NO_CREATE.has(flag))
+      return null;
+    if (BRANCH_RENAME.has(flag))
+      rename = true;
+    else if (!arg.startsWith("-"))
+      positionals.push(arg);
+  }
+  if (positionals.length < 1 || positionals.length > 2)
+    return null;
+  return rename ? positionals.at(-1) ?? null : positionals[0];
+};
+var gitBranchCreation = (args) => {
+  const [sub, second] = args;
+  const target = sub === "switch" ? flagValue(args, SWITCH_CREATE) : sub === "checkout" ? flagValue(args, CHECKOUT_CREATE) : sub === "branch" ? branchCommandTarget(args) : sub === "worktree" && second === "add" ? worktreeTarget(args.slice(1)) : null;
+  return target && !target.startsWith("-") && !UNKNOWABLE.test(target) ? target : null;
+};
+var shellBranchTargets = (command, dialect = "posix") => {
+  if (!/\bgit\b/u.test(command))
+    return [];
+  const found = [];
+  for (const invocation of rawInvocations(command, dialect)) {
+    if (invocation.tool !== "git")
+      continue;
+    const branch = gitBranchCreation(invocation.args);
+    if (branch)
+      found.push({ branch, dir: invocation.dir });
+  }
+  return found;
+};
+var localBranchExists = (dir, branch) => spawnSync12("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], {
+  cwd: dir,
+  stdio: "ignore",
+  timeout: 5000
+}).status === 0;
+var shellBranchPolicyViolation = (root, command, dialect = "posix") => {
+  let judged = false;
+  for (const target of shellBranchTargets(command, dialect)) {
+    if (target.dir === undefined)
+      continue;
+    const dir = target.dir === null ? root : path20.resolve(root, target.dir);
+    if (target.dir !== null && (!existsSync6(dir) || !inWorkitWorkspace(dir)))
+      continue;
+    if (localBranchExists(dir, target.branch))
+      continue;
+    judged = true;
+    const check = validateBranchNameFor(dir, target.branch);
+    if (!check.ok)
+      return check;
+  }
+  return judged ? { ok: true } : null;
+};
+
+// packages/workit-core/src/hooks/policy.ts
+var shellPolicy = (cwd, command, dialect = "posix") => {
+  const policy = shellBranchPolicyViolation(cwd, command, dialect);
+  return policy && !policy.ok ? { kind: "deny", reason: `branch_policy_denied: ${policy.error}`, unblock: null } : { kind: "none" };
+};
+// packages/workit-core/src/hooks/write-gate.ts
+import { realpathSync as realpathSync5 } from "node:fs";
+import path21 from "node:path";
+var NONE3 = { kind: "none" };
+var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
+var canonical2 = (file) => {
+  let rest = "";
+  for (let dir = path21.resolve(file);; dir = path21.dirname(dir)) {
+    try {
+      return path21.join(realpathSync5(dir), rest);
+    } catch {
+      if (path21.dirname(dir) === dir)
+        return path21.resolve(file);
+      rest = rest ? path21.join(path21.basename(dir), rest) : path21.basename(dir);
+    }
+  }
+};
+var exempt = (cwd, root, file, plans) => {
+  const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
+  const relative = path21.relative(fold(canonical2(root)), fold(canonical2(path21.resolve(cwd, file))));
+  if (relative.startsWith("..") || path21.isAbsolute(relative))
+    return true;
+  const posix = relative.split(path21.sep).join("/");
+  const segments = posix.split("/");
+  return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
+};
+var PREFIXES3 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
+var operands = (words) => words.filter((item) => !item.startsWith("-"));
+var editsOf = (input) => {
+  let words = input;
+  while (words.length && (PREFIXES3.has(words[0]) || /^\w+=/.test(words[0])))
+    words = words.slice(1);
+  const [verb, ...args] = words;
+  const name = (verb?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+  if (!name || name === "workit" || name === "npx" && args.some((item) => /workit/.test(item)))
+    return [];
+  switch (name) {
+    case "touch":
+    case "mkdir":
+    case "rm":
+    case "rmdir":
+    case "tee":
+    case "mv":
+    case "truncate":
+      return operands(args);
+    case "cp":
+    case "ln":
+    case "install": {
+      const target = args.indexOf("-t");
+      if (target >= 0)
+        return args[target + 1] ? [args[target + 1]] : null;
+      const last = operands(args).at(-1);
+      return last ? [last] : null;
+    }
+    case "dd":
+      return args.filter((item) => item.startsWith("of=")).map((item) => item.slice(3));
+    case "sed":
+    case "perl": {
+      if (!args.some((item) => /^-[a-zA-Z]*i|^--in-place/.test(item)))
+        return [];
+      const scripted = args.some((item) => item === "-e" || item === "-f");
+      const files = [];
+      for (let index = 0;index < args.length; index++) {
+        if (args[index] === "-e" || args[index] === "-f")
+          index++;
+        else if (!args[index].startsWith("-"))
+          files.push(args[index]);
+      }
+      return scripted ? files : files.slice(1);
+    }
+    case "patch":
+      return null;
+    case "set-content":
+    case "add-content":
+    case "out-file":
+    case "new-item":
+    case "ni":
+    case "remove-item":
+    case "del":
+    case "copy-item":
+    case "move-item": {
+      const flag = args.findIndex((item) => /^-(?:path|filepath|literalpath|destination)$/i.test(item));
+      if (flag >= 0)
+        return args[flag + 1] ? [args[flag + 1]] : null;
+      const files = operands(args);
+      if (name === "move-item")
+        return files.length ? files : null;
+      const file = name === "copy-item" ? files.at(-1) : files[0];
+      return file ? [file] : null;
+    }
+    case "git": {
+      const sub = operands(args)[0];
+      if (sub === "apply")
+        return null;
+      if (sub === "restore" || sub === "mv" || sub === "rm")
+        return operands(args).slice(1);
+      if (sub === "checkout" && args.includes("--"))
+        return args.slice(args.indexOf("--") + 1);
+      return [];
+    }
+    default:
+      return [];
+  }
+};
+var shellWrites = (command) => {
+  const targets = [];
+  let unknown = false;
+  for (const segment of segmentsOf(command)) {
+    targets.push(...segment.redirects.filter((item) => !/^\/dev\/(?:null|stdout|stderr|tty)$/.test(item)));
+    const edits = editsOf(segment.words);
+    if (edits === null)
+      unknown = true;
+    else
+      targets.push(...edits);
+  }
+  if (!unknown && targets.length === 0)
+    return { writes: false, targets: null };
+  return { writes: true, targets: unknown ? null : targets };
+};
+var cache2 = new Map;
+var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path21.resolve(root, file)) ?? "-").join("\x00");
+var gateFor = (cwd) => {
+  const store = new TaskStore(cwd);
+  const listed = store.listTaskIndex();
+  if (!listed.ok)
+    return null;
+  const key = store.currentKey();
+  if (!key.ok)
+    return null;
+  const entry = listed.data.filter((item) => item.key === key.data.key && item.status !== "closed").toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
+  if (!entry)
+    return { blockers: [], root: store.root, plans: new Set };
+  const ledger = ledgerPath(store.root);
+  const cacheKey = `${entry.id}\x00${entry.revision}\x00${ledger.ok && fileSignature(ledger.value) || "-"}`;
+  const hit = cache2.get(store.root);
+  if (hit && hit.key === cacheKey && hit.planKey === planKeyOf(store.root, hit.plans))
+    return hit;
+  const task = store.readTask(entry.id);
+  if (!task.ok)
+    return null;
+  const workspace = store.readWorkspace();
+  const plans = new Set((latestJudgment(task.data)?.refs ?? []).flatMap((ref) => ref.kind === "file" ? [ref.path] : []));
+  const blockers = writeBlockers(task.data, store.root).filter((blocker) => {
+    const requirement = task.data.policy?.requirements.find((item) => item.ruleId === blocker.ruleId && item.before === "write");
+    return !(requirement?.acceptanceAllowed && workspace.ok && workspace.data && applicableDecision(task.data, workspace.data, requirement, store.root).length > 0);
+  });
+  const gate = {
+    blockers,
+    root: store.root,
+    plans,
+    key: cacheKey,
+    planKey: planKeyOf(store.root, plans)
+  };
+  cache2.set(store.root, gate);
+  if (cache2.size > 32)
+    cache2.delete(cache2.keys().next().value);
+  return gate;
+};
+function writeGate(cwd, paths) {
+  try {
+    const gate = gateFor(cwd);
+    if (!gate || gate.blockers.length === 0)
+      return NONE3;
+    if (paths?.length && paths.every((file) => exempt(cwd, gate.root, file, gate.plans)))
+      return NONE3;
+    const reasons = gate.blockers.map((item) => `${item.ruleId}: ${item.reason}`).join("; ");
+    return {
+      kind: "deny",
+      reason: `workit before-write gate: ${reasons}. Markdown, docs/, plans/ and files outside the checkout stay writable.`,
+      unblock: gate.blockers[0].reason
+    };
+  } catch {
+    return NONE3;
+  }
+}
 // packages/workit-core/src/hooks/stop.ts
+import { spawnSync as spawnSync13 } from "node:child_process";
 var NONE4 = { kind: "none" };
 var QUESTION = /[?？؟](?=[\s*_`"')\]>]*(?:\s|$))|¿/;
 var OFFER = /\b(?:let me know|want me to|should I|shall I|would you like|do you want|if you(?:'d| would) like|may I|can I go ahead)\b/i;
@@ -18657,7 +18969,7 @@ var asksUser = (message) => {
 };
 var short = (sha) => (sha ?? "?").slice(0, 12);
 var gitList = (cwd, args) => {
-  const run = spawnSync12("git", args, {
+  const run = spawnSync13("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 3000,
@@ -19020,13 +19332,13 @@ ${line}` };
   return decision;
 };
 // packages/workit-core/src/hooks/hosts/fields.ts
-import { existsSync as existsSync6, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
-import path21 from "node:path";
+import { existsSync as existsSync7, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
+import path22 from "node:path";
 var isRecord4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path21.isAbsolute(value) || !existsSync6(value))
+  if (!nonEmpty2(value) || !path22.isAbsolute(value) || !existsSync7(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -19109,19 +19421,20 @@ var workitRole = (descriptor, agentType) => {
 };
 var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
 var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
-var ISOLATED_GIT = 'Run git as plain, separate commands inside your worktree (`git switch -c <branch> <base>`, `git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a commit-msg hook that adds the trailer), never `workit git …`: Claude Code\'s worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (`workit check`, `workit ledger`, `workit pr`).';
+var isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
 var subagentStartText = (input, descriptor, event) => {
   const session = input.session.id ?? null;
   const role = workitRole(descriptor, event.agentType);
   const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
   const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
+  const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
-    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${ISOLATED_GIT} Use a policy-compliant branch (e.g. feature/<slug>); branch policy hooks still deny protected or non-compliant branches. Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
-    return `${ISOLATED_GIT}
+    return `${isolatedGit(input.cwd)}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
-    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (e.g. feature/<slug>); branch policy hooks still deny protected or non-compliant branches. Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
@@ -19161,7 +19474,7 @@ function handleHook(input, deps) {
       if (skillRead)
         recordSkillLoad(input, skillRead, "read");
       const canDeny = usable2(descriptor.shellPolicy.deny);
-      const policy = canDeny ? shellPolicy(input.cwd, event.command) : NONE5;
+      const policy = canDeny ? shellPolicy(input.cwd, event.command, event.dialect) : NONE5;
       if (policy.kind !== "none")
         return policy;
       const postTool = usable2(descriptor.events["shell.post"].support);
@@ -19764,7 +20077,7 @@ var codexAdapter = {
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
 import fs17 from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 var undocumented = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
@@ -19961,7 +20274,7 @@ var protocolEvent2 = (input) => {
 };
 var TRANSCRIPT_TAIL_BYTES = 256 * 1024;
 var lastAssistantText = (file) => {
-  if (!file || !path22.isAbsolute(file))
+  if (!file || !path23.isAbsolute(file))
     return null;
   try {
     const size = fs17.statSync(file).size;
@@ -19998,7 +20311,7 @@ var lastAssistantText = (file) => {
     return null;
   }
 };
-var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path22.sep) ? root : `${root}${path22.sep}`);
+var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path23.sep) ? root : `${root}${path23.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")