npm - @brainervirus/workit-codex - Versions diffs - 8.13.0 → 8.13.1 - Mend

@brainervirus/workit-codex 8.13.0 → 8.13.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/.codex-plugin/plugin.json +1 -1
package/agents/workit-reviewer.toml +2 -2
package/agents/workit-verifier.toml +2 -2
package/dist/launch-mcp.js +641 -401
package/dist/{workit-hook-sc45d7h1.js → workit-hook-j1zd509p.js} +224 -33
package/dist/workit-hook.js +1 -1
package/package.json +4 -4
package/skills/workit-fanout/references/orchestration.md +4 -3
package/skills/workit-review/SKILL.md +1 -1

package/dist/launch-mcp.js CHANGED Viewed

@@ -6622,13 +6622,13 @@ var require_dist = __commonJS(function(exports, module) {
 // packages/workit-codex/scripts/launch-mcp.ts
 import { existsSync as existsSync10, realpathSync as realpathSync7, statSync as statSync3 } from "node:fs";
-import path22 from "node:path";
+import path24 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 // packages/workit-core/src/core.ts
 import { spawnSync as spawnSync14 } from "node:child_process";
 import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
-import path19 from "node:path";
+import path21 from "node:path";
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -15456,9 +15456,9 @@ function parseAdvertisedOperation(family, input, host) {
   });
 }
 // packages/workit-core/src/core/task-store.ts
-import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
-import * as fs7 from "node:fs";
-import path6 from "node:path";
+import { createHash as createHash5, randomUUID as randomUUID3 } from "node:crypto";
+import * as fs8 from "node:fs";
+import path8 from "node:path";
 // node_modules/@openclaw/fs-safe/dist/errors.js
 var OPERATIONAL_CODES = new Set([
@@ -16061,8 +16061,14 @@ function acquireFileLockSync(targetPath, options) {
     }
   }
 }
+// packages/workit-core/src/host-session.ts
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
+import fs5 from "node:fs";
+import path5 from "node:path";
 // packages/workit-core/src/core/logger.ts
 import os from "node:os";
+import path3 from "node:path";
 var REDACTED = "[REDACTED]";
 var SECRET_VALUE = /\b(?:Bearer|Basic|Digest|Token)\s+\S+/gi;
 var KEY_EQ_VALUE = /\b([A-Za-z0-9_-]*(?:token|secret|password|passwd|apikey|api[_-]?key|authorization|credential|bearer)[A-Za-z0-9_-]*)([:=]\s*).+/gi;
@@ -16105,6 +16111,22 @@ var SENSITIVE_WORDS = new Set([
 ]);
 var STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
 var escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var resolveStateDir = () => {
+  const override = process.env.WORKFLOW_TOOLKIT_STATE;
+  if (override)
+    return override;
+  const home = os.homedir();
+  if (process.env.XDG_STATE_HOME)
+    return path3.join(process.env.XDG_STATE_HOME, "workit");
+  switch (os.platform()) {
+    case "darwin":
+      return path3.join(home, "Library", "Application Support", "workit");
+    case "win32":
+      return path3.join(process.env.LOCALAPPDATA ?? path3.join(home, "AppData", "Local"), "workit");
+    default:
+      return path3.join(process.env.HOME ?? home, ".local", "state", "workit");
+  }
+};
 var homePattern = new RegExp(`${escapeRegExp(os.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
 var applyPatterns = (value) => {
   let out = value;
@@ -16122,7 +16144,7 @@ var redactSecrets = (value) => applyPatterns(value);
 import { spawnSync } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import fs4 from "node:fs";
-import path3 from "node:path";
+import path4 from "node:path";
 var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
 var gitRun = (cwd, args) => {
   const run = spawnSync("git", args, {
@@ -16164,14 +16186,14 @@ var DISCOVERY_ENV = [
 ];
 var isGitDir = (dir) => {
   try {
-    return fs4.statSync(path3.join(dir, "HEAD")).isFile() && fs4.statSync(path3.join(dir, "objects")).isDirectory() && fs4.statSync(path3.join(dir, "refs")).isDirectory();
+    return fs4.statSync(path4.join(dir, "HEAD")).isFile() && fs4.statSync(path4.join(dir, "objects")).isDirectory() && fs4.statSync(path4.join(dir, "refs")).isDirectory();
   } catch {
     return false;
   }
 };
 var reftableRefs = (common) => {
   try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs4.readFileSync(path3.join(common, "config"), "utf8"));
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs4.readFileSync(path4.join(common, "config"), "utf8"));
   } catch {
     return false;
   }
@@ -16191,7 +16213,7 @@ function fastGit(root) {
     if (device !== null && stat.dev !== device)
       return { kind: "none" };
     device = stat.dev;
-    const dotGit = path3.join(dir, ".git");
+    const dotGit = path4.join(dir, ".git");
     let entry = null;
     try {
       entry = fs4.statSync(dotGit);
@@ -16212,19 +16234,19 @@ function fastGit(root) {
         const match = /^gitdir: (.+)$/mu.exec(text);
         if (!match)
           return null;
-        gitDir = path3.resolve(dir, match[1].trim());
+        gitDir = path4.resolve(dir, match[1].trim());
       } else
         return null;
-      if (!fs4.existsSync(path3.join(gitDir, "HEAD")))
+      if (!fs4.existsSync(path4.join(gitDir, "HEAD")))
         return null;
     } else if (isGitDir(dir))
       gitDir = dir;
     if (gitDir) {
       let common = gitDir;
       try {
-        common = path3.resolve(gitDir, fs4.readFileSync(path3.join(gitDir, "commondir"), "utf8").trim());
+        common = path4.resolve(gitDir, fs4.readFileSync(path4.join(gitDir, "commondir"), "utf8").trim());
       } catch {}
-      if (!fs4.existsSync(path3.join(common, "objects")))
+      if (!fs4.existsSync(path4.join(common, "objects")))
         return null;
       return {
         kind: "repo",
@@ -16234,26 +16256,26 @@ function fastGit(root) {
         reftable: reftableRefs(common)
       };
     }
-    const parent = path3.dirname(dir);
+    const parent = path4.dirname(dir);
     if (parent === dir)
       return { kind: "none" };
     dir = parent;
   }
 }
 function resolveStore(root) {
-  root = path3.resolve(root);
+  root = path4.resolve(root);
   let directory = false;
   try {
     directory = fs4.statSync(root).isDirectory();
   } catch {}
   if (!directory)
-    return { dir: path3.join(root, ".workit"), shared: false, top: null };
+    return { dir: path4.join(root, ".workit"), shared: false, top: null };
   const fast = fastGit(root);
   if (fast?.kind === "none")
-    return { dir: path3.join(root, ".workit"), shared: false, top: null };
+    return { dir: path4.join(root, ".workit"), shared: false, top: null };
   if (fast?.kind === "repo")
     return {
-      dir: path3.join(fast.common, "workit"),
+      dir: path4.join(fast.common, "workit"),
       shared: true,
       top: fast.top,
       git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
@@ -16263,20 +16285,20 @@ function resolveStore(root) {
   if (run.ok && common) {
     const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
     return {
-      dir: path3.join(real(path3.resolve(root, common)), "workit"),
+      dir: path4.join(real(path4.resolve(root, common)), "workit"),
       shared: true,
       top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
     };
   }
   if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path3.join(root, ".workit"), shared: false, top: null };
+    return { dir: path4.join(root, ".workit"), shared: false, top: null };
   return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
 `)[0] || "no output"}); fix the repository (git status should work here)`);
 }
 var rebasingBranch = (gitDir) => {
   for (const state of ["rebase-merge", "rebase-apply"]) {
     try {
-      const ref = fs4.readFileSync(path3.join(gitDir, state, "head-name"), "utf8").trim();
+      const ref = fs4.readFileSync(path4.join(gitDir, state, "head-name"), "utf8").trim();
       const match = /^refs\/heads\/(.+)$/u.exec(ref);
       if (match)
         return match[1];
@@ -16291,7 +16313,7 @@ function resolveTaskKey(root, location) {
   if (location.git && !location.git.reftable) {
     let head = "";
     try {
-      head = fs4.readFileSync(path3.join(location.git.gitDir, "HEAD"), "utf8").trim();
+      head = fs4.readFileSync(path4.join(location.git.gitDir, "HEAD"), "utf8").trim();
     } catch {}
     const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
     if (ref && ref[1] !== ".invalid")
@@ -16322,7 +16344,7 @@ function resolveTaskKey(root, location) {
   return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
 }
 function checkoutRootOf(root, location) {
-  const resolved = path3.resolve(root);
+  const resolved = path4.resolve(root);
   let canonical = resolved;
   try {
     canonical = fs4.realpathSync(resolved);
@@ -16353,13 +16375,13 @@ function branchRenames(location) {
     }
     for (const entry of entries)
       if (entry.isDirectory())
-        walk(path3.join(dir, entry.name));
+        walk(path4.join(dir, entry.name));
       else
-        files.push(path3.join(dir, entry.name));
+        files.push(path4.join(dir, entry.name));
   };
-  walk(path3.join(path3.dirname(location.dir), "logs", "refs", "heads"));
+  walk(path4.join(path4.dirname(location.dir), "logs", "refs", "heads"));
   if (location.git)
-    files.push(path3.join(location.git.gitDir, "logs", "HEAD"));
+    files.push(path4.join(location.git.gitDir, "logs", "HEAD"));
   const seen = new Set;
   const renames = [];
   for (const file of files) {
@@ -16394,7 +16416,7 @@ var checkoutSlug = (root) => {
   let canonical = real(root);
   if (process.platform === "win32")
     canonical = canonical.toLowerCase();
-  const base = path3.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  const base = path4.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
   return `${base}-${shortHash(canonical)}`;
 };
@@ -16426,30 +16448,113 @@ function hostSessionFromEnv(env) {
   }
   return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
 }
+var hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32);
+var userIssuedRoot = () => path5.join(resolveStateDir(), "issued");
+var userTokenRoot = () => path5.join(resolveStateDir(), "issued-tokens");
+function migrateRepoIssued(cwd) {
+  if (cwd === undefined)
+    return;
+  let old;
+  try {
+    const location = resolveStore(cwd);
+    if (location instanceof Error)
+      return;
+    old = path5.join(location.dir, "hooks", "issued");
+    if (!fs5.existsSync(old))
+      return;
+  } catch {
+    return;
+  }
+  for (const lead of safeList(old)) {
+    try {
+      const from = path5.join(old, lead);
+      if (!fs5.statSync(from).isDirectory())
+        continue;
+      const to = path5.join(userIssuedRoot(), lead);
+      fs5.mkdirSync(to, { recursive: true, mode: 448 });
+      for (const id of fs5.readdirSync(from)) {
+        try {
+          fs5.copyFileSync(path5.join(from, id), path5.join(to, id), fs5.constants.COPYFILE_EXCL);
+        } catch (error) {
+          if (error.code !== "EEXIST")
+            throw error;
+        }
+        fs5.rmSync(path5.join(from, id), { force: true });
+      }
+      removeIfEmpty(from);
+    } catch {}
+  }
+  removeIfEmpty(old);
+}
+var safeList = (dir) => {
+  try {
+    return fs5.readdirSync(dir);
+  } catch {
+    return [];
+  }
+};
+var removeIfEmpty = (dir) => {
+  try {
+    fs5.rmdirSync(dir);
+  } catch {}
+};
+var issuedRecord = (cwd, claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return null;
+  migrateRepoIssued(cwd);
+  try {
+    return fs5.readFileSync(path5.join(userIssuedRoot(), hash(claimed.slice(0, cut)), hash(claimed)), "utf8");
+  } catch {
+    return null;
+  }
+};
+var TOKEN_HASH = /^([0-9a-f]{64})$/mu;
+var issuedToken = (claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return { stored: null, leadBound: false };
+  const dir = path5.join(userTokenRoot(), hash(claimed.slice(0, cut)));
+  try {
+    const text = fs5.readFileSync(path5.join(dir, hash(claimed)), "utf8");
+    return { stored: TOKEN_HASH.exec(text)?.[1] ?? null, leadBound: true };
+  } catch {
+    return { stored: null, leadBound: safeList(dir).length > 0 };
+  }
+};
+function issuedBinding(cwd, claimed) {
+  const record = issuedRecord(cwd, claimed);
+  const { stored, leadBound } = issuedToken(claimed);
+  if (stored)
+    return "token";
+  if (record === null)
+    return null;
+  return leadBound ? "token" : "legacy";
+}
 var OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
 // packages/workit-core/src/core/package-root.ts
 import { existsSync } from "node:fs";
-import path4 from "node:path";
+import path6 from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = () => {
-  let dir = path4.dirname(fileURLToPath(import.meta.url));
+  let dir = path6.dirname(fileURLToPath(import.meta.url));
   while (true) {
-    const parent = path4.dirname(dir);
-    if (existsSync(path4.join(dir, "package.json")) || parent === dir)
+    const parent = path6.dirname(dir);
+    if (existsSync(path6.join(dir, "package.json")) || parent === dir)
       return dir;
     dir = parent;
   }
 };
 var assetRoot = () => {
   const root = packageRoot();
-  const assets = path4.join(root, "assets");
+  const assets = path6.join(root, "assets");
   return existsSync(assets) ? assets : root;
 };
 // packages/workit-core/src/core/store-lock.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 import { hostname } from "node:os";
 var metadataLockSchema = object({
   pid: number2().int().nonnegative().safe(),
@@ -16461,8 +16566,10 @@ var metadataLockSchema = object({
 var FOREIGN_LOCK_TTL_MS = 10 * 60000;
 var UNREADABLE_LOCK_TTL_MS = 30000;
 var RECLAIM_GUARD_TTL_MS = 30000;
-var defaultLockTimeoutMs = 250;
+var IN_PROCESS_LOCK_TIMEOUT_MS = 250;
+var defaultLockTimeoutMs = IN_PROCESS_LOCK_TIMEOUT_MS;
 var defaultLockTimeout = () => defaultLockTimeoutMs;
+var hostAwareLockTimeout = (cliMs) => defaultLockTimeoutMs > IN_PROCESS_LOCK_TIMEOUT_MS ? cliMs : IN_PROCESS_LOCK_TIMEOUT_MS;
 var parseMetadataLock = (raw) => {
   let value;
   try {
@@ -16491,7 +16598,7 @@ var parseProcStatStart = (stat) => {
 var processStartOf = (pid) => {
   if (process.platform === "linux") {
     try {
-      return parseProcStatStart(fs5.readFileSync(`/proc/${pid}/stat`, "utf8"));
+      return parseProcStatStart(fs6.readFileSync(`/proc/${pid}/stat`, "utf8"));
     } catch {
       return null;
     }
@@ -16512,7 +16619,7 @@ var processStartOf = (pid) => {
 };
 var readTrimmed = (file) => {
   try {
-    return fs5.readFileSync(file, "utf8").trim() || null;
+    return fs6.readFileSync(file, "utf8").trim() || null;
   } catch {
     return null;
   }
@@ -16523,7 +16630,7 @@ var localLockHost = () => {
     return cachedLockHost;
   let pidns = null;
   try {
-    pidns = /\[(\d+)\]/.exec(fs5.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
+    pidns = /\[(\d+)\]/.exec(fs6.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
   } catch {}
   const boot = readTrimmed("/proc/sys/kernel/random/boot_id");
   cachedLockHost = pidns || boot ? `${hostname()}#${pidns ?? "?"}:${boot ?? "?"}` : hostname();
@@ -16569,7 +16676,7 @@ var classifyLockOwner = (payload, ageMs, localHost = localLockHost(), options =
 };
 var ageOf = (file, nowMs) => {
   try {
-    return nowMs - fs5.lstatSync(file).mtimeMs;
+    return nowMs - fs6.lstatSync(file).mtimeMs;
   } catch {
     return null;
   }
@@ -16580,7 +16687,7 @@ var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
   if (age === null || age <= RECLAIM_GUARD_TTL_MS)
     return false;
   try {
-    fs5.rmdirSync(guard);
+    fs6.rmdirSync(guard);
     return true;
   } catch {
     return false;
@@ -16589,8 +16696,8 @@ var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import fs6 from "node:fs";
-import path5 from "node:path";
+import fs7 from "node:fs";
+import path7 from "node:path";
 var EVENT_VERSION = 1;
 class LogDamage extends Error {
@@ -16619,7 +16726,7 @@ var parseEvent = (line, file, offset) => {
 function readLog(file, from = 0, expectSeq = null) {
   let fd;
   try {
-    fd = fs6.openSync(file, "r");
+    fd = fs7.openSync(file, "r");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -16628,13 +16735,13 @@ function readLog(file, from = 0, expectSeq = null) {
   let bytes;
   let size;
   try {
-    size = fs6.fstatSync(fd).size;
+    size = fs7.fstatSync(fd).size;
     if (from > size)
       throw new LogDamage(`${file}: shorter than its snapshot`);
     bytes = Buffer.alloc(size - from);
     let read = 0;
     while (read < bytes.length) {
-      const got = fs6.readSync(fd, bytes, read, bytes.length - read, from + read);
+      const got = fs7.readSync(fd, bytes, read, bytes.length - read, from + read);
       if (got === 0)
         break;
       read += got;
@@ -16642,7 +16749,7 @@ function readLog(file, from = 0, expectSeq = null) {
     bytes = bytes.subarray(0, read);
     size = from + read;
   } finally {
-    fs6.closeSync(fd);
+    fs7.closeSync(fd);
   }
   const events = [];
   let start = 0;
@@ -16667,11 +16774,11 @@ function readLog(file, from = 0, expectSeq = null) {
 }
 var fsyncDirectory = (dir) => {
   try {
-    const fd = fs6.openSync(dir, "r");
+    const fd = fs7.openSync(dir, "r");
     try {
-      fs6.fsyncSync(fd);
+      fs7.fsyncSync(fd);
     } finally {
-      fs6.closeSync(fd);
+      fs7.closeSync(fd);
     }
   } catch (error) {
     if (process.platform !== "win32")
@@ -16681,46 +16788,46 @@ var fsyncDirectory = (dir) => {
 function appendEvent(file, event, validEnd) {
   const line = Buffer.from(`${JSON.stringify(event)}
 `, "utf8");
-  const created = !fs6.existsSync(file);
-  if (!created && fs6.statSync(file).size !== validEnd) {
-    const cut = fs6.openSync(file, "r+");
+  const created = !fs7.existsSync(file);
+  if (!created && fs7.statSync(file).size !== validEnd) {
+    const cut = fs7.openSync(file, "r+");
     try {
-      fs6.ftruncateSync(cut, validEnd);
-      fs6.fsyncSync(cut);
+      fs7.ftruncateSync(cut, validEnd);
+      fs7.fsyncSync(cut);
     } finally {
-      fs6.closeSync(cut);
+      fs7.closeSync(cut);
     }
   }
-  const fd = fs6.openSync(file, "a", 384);
+  const fd = fs7.openSync(file, "a", 384);
   try {
     let written = 0;
     while (written < line.length)
-      written += fs6.writeSync(fd, line, written, line.length - written);
-    fs6.fsyncSync(fd);
+      written += fs7.writeSync(fd, line, written, line.length - written);
+    fs7.fsyncSync(fd);
   } finally {
-    fs6.closeSync(fd);
+    fs7.closeSync(fd);
   }
   if (created)
-    fsyncDirectory(path5.dirname(file));
+    fsyncDirectory(path7.dirname(file));
   return validEnd;
 }
 function replaceFile(file, bytes, durable) {
   const temporary = `${file}.${process.pid}.${randomUUID2()}.tmp`;
   try {
-    const fd = fs6.openSync(temporary, "wx", 384);
+    const fd = fs7.openSync(temporary, "wx", 384);
     try {
-      fs6.writeSync(fd, bytes);
+      fs7.writeSync(fd, bytes);
       if (durable)
-        fs6.fsyncSync(fd);
+        fs7.fsyncSync(fd);
     } finally {
-      fs6.closeSync(fd);
+      fs7.closeSync(fd);
     }
     renameWithRetry(temporary, file);
     if (durable)
-      fsyncDirectory(path5.dirname(file));
+      fsyncDirectory(path7.dirname(file));
   } catch (error) {
     try {
-      fs6.unlinkSync(temporary);
+      fs7.unlinkSync(temporary);
     } catch {}
     throw error;
   }
@@ -16745,7 +16852,7 @@ var retryTransient = (run) => {
     }
   }
 };
-var renameWithRetry = (from, to) => retryTransient(() => fs6.renameSync(from, to));
+var renameWithRetry = (from, to) => retryTransient(() => fs7.renameSync(from, to));
 // packages/workit-core/src/store/patch.ts
 var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -16858,7 +16965,7 @@ var isPatch = (value) => Array.isArray(value) && value.every((op) => {
 });
 // packages/workit-core/src/store/reduce.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 var OPENING_TYPES = new Set([
   "task.opened",
   "task.imported",
@@ -16887,7 +16994,7 @@ var isObject4 = (value) => typeof value === "object" && value !== null && !Array
 var isKey = (value) => isObject4(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string");
 var BLOB_REF = "$blob";
 var blobRef = (value) => isObject4(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null;
-var blobDigest = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+var blobDigest = (value) => createHash4("sha256").update(JSON.stringify(value)).digest("hex");
 var toBlob = (value, blobs) => {
   if (!isObject4(value))
     return value;
@@ -17042,7 +17149,7 @@ var indexEntry = (task, key, legacy, file) => {
 };
 var fileSignature = (file) => {
   try {
-    const stat = fs7.statSync(file, { bigint: true });
+    const stat = fs8.statSync(file, { bigint: true });
     return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
   } catch {
     return null;
@@ -17060,7 +17167,7 @@ var cachedRuntimeVersion = null;
 var runtimeVersion = () => {
   if (cachedRuntimeVersion === null) {
     try {
-      const pkg = JSON.parse(fs7.readFileSync(path6.join(packageRoot(), "package.json"), "utf8"));
+      const pkg = JSON.parse(fs8.readFileSync(path8.join(packageRoot(), "package.json"), "utf8"));
       cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
     } catch {
       cachedRuntimeVersion = "0.0.0";
@@ -17086,14 +17193,14 @@ var isNewerVersion = (candidate, current) => {
 var validId = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
 var readText = (file) => {
   try {
-    return fs7.readFileSync(file, "utf8");
+    return fs8.readFileSync(file, "utf8");
   } catch {
     return "";
   }
 };
 var REFLOG_LINE = /^[0-9a-f]+ ([0-9a-f]+) .* (\d+) [+-]\d{4}\t(.*)$/u;
 var branchStart = (location, branch, aliases) => {
-  const first = readText(path6.join(path6.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
+  const first = readText(path8.join(path8.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
 `, 1)[0];
   const created = REFLOG_LINE.exec(first);
   const start = created && /^branch: Created from (\S+)$/u.exec(created[3])?.[1];
@@ -17103,7 +17210,7 @@ var branchStart = (location, branch, aliases) => {
     return start;
   if (!location.git)
     return null;
-  for (const line of readText(path6.join(location.git.gitDir, "logs", "HEAD")).split(`
+  for (const line of readText(path8.join(location.git.gitDir, "logs", "HEAD")).split(`
 `)) {
     const entry = REFLOG_LINE.exec(line);
     const moved = entry && /^checkout: moving from (\S+) to (\S+)$/u.exec(entry[3]);
@@ -17113,23 +17220,23 @@ var branchStart = (location, branch, aliases) => {
   }
   return null;
 };
-var refExists = (common, ref) => fs7.existsSync(path6.join(common, ref)) || readText(path6.join(common, "packed-refs")).includes(` ${ref}
+var refExists = (common, ref) => fs8.existsSync(path8.join(common, ref)) || readText(path8.join(common, "packed-refs")).includes(` ${ref}
 `);
 var origins = new Map;
 var sameDirectoryIdentity = (left, right) => {
-  if (!path6.isAbsolute(left) || !path6.isAbsolute(right))
+  if (!path8.isAbsolute(left) || !path8.isAbsolute(right))
     return false;
-  const normalizedLeft = path6.resolve(left);
-  const normalizedRight = path6.resolve(right);
+  const normalizedLeft = path8.resolve(left);
+  const normalizedRight = path8.resolve(right);
   try {
-    const a = fs7.statSync(normalizedLeft, { bigint: true });
-    const b = fs7.statSync(normalizedRight, { bigint: true });
+    const a = fs8.statSync(normalizedLeft, { bigint: true });
+    const b = fs8.statSync(normalizedRight, { bigint: true });
     if (!a.isDirectory() || !b.isDirectory())
       return false;
     if (process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight)
       return true;
-    const canonicalLeft = fs7.realpathSync(normalizedLeft);
-    const canonicalRight = fs7.realpathSync(normalizedRight);
+    const canonicalLeft = fs8.realpathSync(normalizedLeft);
+    const canonicalRight = fs8.realpathSync(normalizedRight);
     if (process.platform === "win32" ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase() : canonicalLeft === canonicalRight)
       return true;
     return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
@@ -17166,8 +17273,8 @@ class TaskStore {
   migrationChecked = false;
   compactDue = new Set;
   constructor(root, options = {}) {
-    const resolved = path6.resolve(root);
-    this.origin = fs7.existsSync(resolved) ? fs7.realpathSync(resolved) : resolved;
+    const resolved = path8.resolve(root);
+    this.origin = fs8.existsSync(resolved) ? fs8.realpathSync(resolved) : resolved;
     this.located = resolveStore(this.origin);
     this.root = checkoutRootOf(this.origin, this.located);
     this.lockTimeoutMs = options.lockTimeoutMs ?? defaultLockTimeout();
@@ -17175,7 +17282,7 @@ class TaskStore {
     this.migrateOnRead = options.migrateOnRead;
   }
   location() {
-    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs7.existsSync(path6.join(this.root, ".git"))) {
+    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs8.existsSync(path8.join(this.root, ".git"))) {
       this.located = undefined;
       this.migrationChecked = false;
     }
@@ -17239,7 +17346,7 @@ class TaskStore {
     const tasksDir = this.paths().tasks;
     let names;
     try {
-      names = fs7.existsSync(tasksDir) ? fs7.readdirSync(tasksDir).filter((name) => validId(name)) : [];
+      names = fs8.existsSync(tasksDir) ? fs8.readdirSync(tasksDir).filter((name) => validId(name)) : [];
     } catch (error) {
       return failure2("storage_error", `unable to list tasks: ${String(error)}`, {
         path: tasksDir
@@ -17280,7 +17387,7 @@ class TaskStore {
     const file = this.paths().workspace;
     let bytes;
     try {
-      bytes = retryTransient(() => fs7.readFileSync(file, "utf8"));
+      bytes = retryTransient(() => fs8.readFileSync(file, "utf8"));
     } catch (error) {
       if (error.code === "ENOENT")
         return success(null, null, null);
@@ -17331,7 +17438,7 @@ class TaskStore {
         const moved = this.bindLocked(again.data.id, key, input.now);
         return moved.ok ? success(moved.data.revision, null, { task: moved.data, created: false, key }) : moved;
       }
-      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path6.basename(this.root) || this.root;
+      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path8.basename(this.root) || this.root;
       const intent = {
         objective: input.objective?.trim() || `Work on ${label}`,
         scope: { description: `the checkout (${label})`, paths: ["."], exclusions: [] },
@@ -17391,14 +17498,14 @@ class TaskStore {
     const branch = key.ok ? key.data.branch : null;
     if (!branch || !location.ok)
       return success(null, null, null);
-    const common = path6.dirname(location.data.dir);
-    const heads = path6.join(common, "logs", "refs", "heads");
-    const headLog = location.data.git ? path6.join(location.data.git.gitDir, "logs", "HEAD") : "";
+    const common = path8.dirname(location.data.dir);
+    const heads = path8.join(common, "logs", "refs", "heads");
+    const headLog = location.data.git ? path8.join(location.data.git.gitDir, "logs", "HEAD") : "";
     const signatures = [
-      path6.join(heads, branch),
+      path8.join(heads, branch),
       headLog,
       heads,
-      path6.join(common, "packed-refs")
+      path8.join(common, "packed-refs")
     ].map((file) => fileSignature(file) ?? "-");
     const slot = `${location.data.dir}\x00${headLog}\x00${branch}`;
     let resolved = origins.get(slot);
@@ -17410,7 +17517,7 @@ class TaskStore {
           aliases.push(rename.from);
       const start = branchStart(location.data, branch, aliases);
       const slash = start?.indexOf("/") ?? -1;
-      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path6.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
+      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path8.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
       const name = start && (remote ? start.slice(slash + 1) : start);
       resolved = {
         signature: signatures.join("|"),
@@ -17648,13 +17755,13 @@ class TaskStore {
     if (!ready.ok)
       return ready;
     const dirs = this.paths();
-    const recovery = path6.join(this.root, ".workit", "recovery");
-    if (fs7.existsSync(recovery)) {
+    const recovery = path8.join(this.root, ".workit", "recovery");
+    if (fs8.existsSync(recovery)) {
       let files = 0;
       let bytes = 0;
       try {
-        for (const name of fs7.readdirSync(recovery)) {
-          const stat = fs7.lstatSync(path6.join(recovery, name));
+        for (const name of fs8.readdirSync(recovery)) {
+          const stat = fs8.lstatSync(path8.join(recovery, name));
           if (!stat.isFile())
             continue;
           files += 1;
@@ -17663,17 +17770,17 @@ class TaskStore {
       } catch {}
       const remove = options.pruneRecovery === true && !dryRun;
       if (remove)
-        fs7.rmSync(recovery, { recursive: true, force: true });
+        fs8.rmSync(recovery, { recursive: true, force: true });
       report.legacyRecovery = { path: recovery, files, bytes, removed: remove };
     }
-    if (!fs7.existsSync(dirs.tasks))
+    if (!fs8.existsSync(dirs.tasks))
       return success(null, null, report);
-    const names = fs7.readdirSync(dirs.tasks).filter((name) => validId(name));
+    const names = fs8.readdirSync(dirs.tasks).filter((name) => validId(name));
     for (const name of names) {
       const file = this.eventsPath(name);
       let size = 0;
       try {
-        size = fs7.statSync(file).size;
+        size = fs8.statSync(file).size;
       } catch {
         continue;
       }
@@ -17701,16 +17808,16 @@ class TaskStore {
       const references = new Set;
       for (const name of names)
         try {
-          for (const match of fs7.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
+          for (const match of fs8.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
             references.add(match[1]);
         } catch {}
-      if (fs7.existsSync(dirs.blobs))
-        for (const name of fs7.readdirSync(dirs.blobs)) {
+      if (fs8.existsSync(dirs.blobs))
+        for (const name of fs8.readdirSync(dirs.blobs)) {
           const digest = name.replace(/\.json$/, "");
-          const file = path6.join(dirs.blobs, name);
+          const file = path8.join(dirs.blobs, name);
           let stat;
           try {
-            stat = fs7.lstatSync(file);
+            stat = fs8.lstatSync(file);
           } catch {
             continue;
           }
@@ -17721,11 +17828,11 @@ class TaskStore {
           report.blobs.removed += 1;
           report.blobs.removedBytes += stat.size;
           if (!dryRun)
-            fs7.rmSync(file, { force: true });
+            fs8.rmSync(file, { force: true });
         }
       return success(null, null, null);
     };
-    const swept = dryRun ? sweep() : this.withLock(path6.join(dirs.dir, "gc.lock"), sweep);
+    const swept = dryRun ? sweep() : this.withLock(path8.join(dirs.dir, "gc.lock"), sweep);
     if (!swept.ok)
       return swept;
     const temporaryDirs = [
@@ -17733,17 +17840,17 @@ class TaskStore {
       dirs.tasks,
       dirs.blobs,
       dirs.checkout,
-      ...names.map((name) => path6.join(dirs.tasks, name))
+      ...names.map((name) => path8.join(dirs.tasks, name))
     ];
     for (const directory of temporaryDirs) {
-      if (!fs7.existsSync(directory))
+      if (!fs8.existsSync(directory))
         continue;
-      for (const name of fs7.readdirSync(directory)) {
+      for (const name of fs8.readdirSync(directory)) {
         if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
           continue;
-        const file = path6.join(directory, name);
+        const file = path8.join(directory, name);
         try {
-          const stat = fs7.lstatSync(file);
+          const stat = fs8.lstatSync(file);
           if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
             continue;
         } catch {
@@ -17751,37 +17858,37 @@ class TaskStore {
         }
         report.temporary.removed += 1;
         if (!dryRun)
-          fs7.rmSync(file, { force: true });
+          fs8.rmSync(file, { force: true });
       }
     }
     return success(null, null, report);
   }
   paths() {
     const location = this.location();
-    const dir = location.ok ? location.data.dir : path6.join(this.root, ".workit");
-    const checkout = path6.join(dir, "checkouts", checkoutSlug(this.root));
+    const dir = location.ok ? location.data.dir : path8.join(this.root, ".workit");
+    const checkout = path8.join(dir, "checkouts", checkoutSlug(this.root));
     return {
       dir,
       shared: location.ok ? location.data.shared : false,
-      marker: path6.join(dir, "store.json"),
+      marker: path8.join(dir, "store.json"),
       checkout,
-      workspace: path6.join(checkout, "workspace.json"),
-      checkoutLock: path6.join(checkout, "metadata.lock"),
-      tasks: path6.join(dir, "tasks"),
-      index: path6.join(dir, "task-index.json"),
-      blobs: path6.join(dir, "blobs", "candidates"),
-      legacy: path6.join(dir, "legacy", checkoutSlug(this.root), "v2"),
-      v2: path6.join(this.root, ".workit")
+      workspace: path8.join(checkout, "workspace.json"),
+      checkoutLock: path8.join(checkout, "metadata.lock"),
+      tasks: path8.join(dir, "tasks"),
+      index: path8.join(dir, "task-index.json"),
+      blobs: path8.join(dir, "blobs", "candidates"),
+      legacy: path8.join(dir, "legacy", checkoutSlug(this.root), "v2"),
+      v2: path8.join(this.root, ".workit")
     };
   }
   eventsPath(taskId) {
-    return path6.join(this.paths().tasks, taskId, "events.jsonl");
+    return path8.join(this.paths().tasks, taskId, "events.jsonl");
   }
   snapshotPath(taskId) {
-    return path6.join(this.paths().tasks, taskId, "snapshot.json");
+    return path8.join(this.paths().tasks, taskId, "snapshot.json");
   }
   taskLockPath(taskId) {
-    return path6.join(this.paths().tasks, taskId, "lock");
+    return path8.join(this.paths().tasks, taskId, "lock");
   }
   ready(write = false) {
     const location = this.location();
@@ -17791,7 +17898,7 @@ class TaskStore {
       return success(null, null, null);
     const dirs = this.paths();
     try {
-      const marker = JSON.parse(fs7.readFileSync(dirs.marker, "utf8"));
+      const marker = JSON.parse(fs8.readFileSync(dirs.marker, "utf8"));
       if (typeof marker.version === "number" && marker.version > STORE_FORMAT)
         return failure2("recovery_required", `the workit store at ${dirs.dir} has format ${marker.version}; upgrade Workit to use it`, { path: dirs.marker });
     } catch {}
@@ -17820,21 +17927,21 @@ class TaskStore {
     return {
       read: (digest) => {
         try {
-          return JSON.parse(fs7.readFileSync(path6.join(dir, `${digest}.json`), "utf8"));
+          return JSON.parse(fs8.readFileSync(path8.join(dir, `${digest}.json`), "utf8"));
         } catch (error) {
           throw new LogDamage(`stored candidate ${digest} is missing or unreadable: ${String(error)}`);
         }
       },
       write: (digest, value) => {
-        const file = path6.join(dir, `${digest}.json`);
-        if (fs7.existsSync(file)) {
+        const file = path8.join(dir, `${digest}.json`);
+        if (fs8.existsSync(file)) {
           const stamp = new Date;
           try {
-            fs7.utimesSync(file, stamp, stamp);
+            fs8.utimesSync(file, stamp, stamp);
             return;
           } catch {}
         }
-        fs7.mkdirSync(dir, { recursive: true });
+        fs8.mkdirSync(dir, { recursive: true });
         replaceFile(file, JSON.stringify(value), true);
       }
     };
@@ -17916,7 +18023,7 @@ class TaskStore {
   }
   readSnapshot(taskId) {
     try {
-      const value = JSON.parse(fs7.readFileSync(this.snapshotPath(taskId), "utf8"));
+      const value = JSON.parse(fs8.readFileSync(this.snapshotPath(taskId), "utf8"));
       if (!isObject5(value) || value.v !== 1 || value.task !== taskId || typeof value.seq !== "number" || typeof value.lastId !== "string" || typeof value.lastStart !== "number" || typeof value.end !== "number" || !isObject5(value.record))
         return null;
       return value;
@@ -18018,8 +18125,8 @@ class TaskStore {
     }
   }
   openTask(record, type, key, legacy = null) {
-    const dir = path6.join(this.paths().tasks, record.id);
-    fs7.mkdirSync(dir, { recursive: true });
+    const dir = path8.join(this.paths().tasks, record.id);
+    fs8.mkdirSync(dir, { recursive: true });
     const blobs = this.blobStore();
     const bound = key ? { ...key, boundAt: key.boundAt ?? new Date().toISOString() } : null;
     const event = this.event(record.id, 1, type, {
@@ -18071,11 +18178,11 @@ class TaskStore {
         } catch {}
         if (!latest || latest.events[0]?.id !== last.id)
           return failure2("busy", "the task log changed during compaction; retry", { taskId });
-        const appended = fs7.readFileSync(file).subarray(log.end, latest.end);
+        const appended = fs8.readFileSync(file).subarray(log.end, latest.end);
         const bytes = Buffer.concat([Buffer.from(prefix, "utf8"), appended]);
         replaceFile(file, bytes.toString("utf8"), true);
         try {
-          fs7.rmSync(this.snapshotPath(taskId), { force: true });
+          fs8.rmSync(this.snapshotPath(taskId), { force: true });
         } catch {}
         const reloaded = this.load(taskId);
         if (reloaded.ok && reloaded.data)
@@ -18088,7 +18195,7 @@ class TaskStore {
   }
   countEvents(file) {
     try {
-      const bytes = fs7.readFileSync(file);
+      const bytes = fs8.readFileSync(file);
       let count = 0;
       for (let index = bytes.indexOf(10);index >= 0; index = bytes.indexOf(10, index + 1))
         count += 1;
@@ -18110,8 +18217,8 @@ class TaskStore {
     return bound.ok ? success(null, null, bound.data[0] ?? null) : bound;
   }
   withKeyLock(key, operation) {
-    const digest = createHash4("sha256").update(key).digest("hex").slice(0, 32);
-    return this.withLock(path6.join(this.paths().dir, "keys", `${digest}.lock`), operation);
+    const digest = createHash5("sha256").update(key).digest("hex").slice(0, 32);
+    return this.withLock(path8.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
     const current = this.readWorkspace();
@@ -18252,7 +18359,7 @@ class TaskStore {
   writeWorkspace(record) {
     const file = this.paths().workspace;
     try {
-      fs7.mkdirSync(path6.dirname(file), { recursive: true });
+      fs8.mkdirSync(path8.dirname(file), { recursive: true });
       replaceFile(file, `${canonicalJson(record)}
 `, true);
       return success(null, null, null);
@@ -18262,7 +18369,7 @@ class TaskStore {
   }
   readIndex() {
     try {
-      const value = JSON.parse(fs7.readFileSync(this.paths().index, "utf8"));
+      const value = JSON.parse(fs8.readFileSync(this.paths().index, "utf8"));
       if (!isObject5(value) || value.version !== INDEX_VERSION || !isObject5(value.tasks))
         return {};
       const tasks = {};
@@ -18276,7 +18383,7 @@ class TaskStore {
   }
   writeIndex(entries) {
     try {
-      fs7.mkdirSync(this.paths().tasks, { recursive: true });
+      fs8.mkdirSync(this.paths().tasks, { recursive: true });
       replaceFile(this.paths().index, JSON.stringify({
         version: INDEX_VERSION,
         tasks: Object.fromEntries(entries.map((entry) => [entry.id, entry]))
@@ -18330,23 +18437,23 @@ class TaskStore {
     return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
   }
   v2Dirs() {
-    return [...new Set([this.root, this.origin])].map((dir) => path6.join(dir, ".workit"));
+    return [...new Set([this.root, this.origin])].map((dir) => path8.join(dir, ".workit"));
   }
   pendingMigrations() {
     return this.v2Dirs().filter((dir) => {
-      const raw = this.readV2Workspace(path6.join(dir, "workspace.json"));
+      const raw = this.readV2Workspace(path8.join(dir, "workspace.json"));
       return raw !== null && raw !== TOMBSTONE;
     });
   }
   migrateV2(v2) {
     const dirs = this.paths();
-    const v2Workspace = path6.join(v2, "workspace.json");
-    const v2Tasks = path6.join(v2, "tasks");
-    const legacy = path6.join(dirs.dir, "legacy", checkoutSlug(path6.dirname(v2)), "v2");
+    const v2Workspace = path8.join(v2, "workspace.json");
+    const v2Tasks = path8.join(v2, "tasks");
+    const legacy = path8.join(dirs.dir, "legacy", checkoutSlug(path8.dirname(v2)), "v2");
     const raw = this.readV2Workspace(v2Workspace);
     if (raw === null || raw === TOMBSTONE)
       return success(null, null, null);
-    return this.withLock(dirs.checkoutLock, () => this.withLock(path6.join(v2, "metadata.lock"), () => {
+    return this.withLock(dirs.checkoutLock, () => this.withLock(path8.join(v2, "metadata.lock"), () => {
       const workspace = this.readV2Workspace(v2Workspace);
       if (workspace === null || workspace === TOMBSTONE)
         return success(null, null, null);
@@ -18355,7 +18462,7 @@ class TaskStore {
         return failure2("recovery_required", `cannot migrate the 2.x store at ${v2}: ${parsedWorkspace.error}; move it aside to start fresh`, { path: v2Workspace });
       let files = [];
       try {
-        files = fs7.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path6.join(v2Tasks, name)));
+        files = fs8.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path8.join(v2Tasks, name)));
       } catch {}
       const current = this.readWorkspace();
       if (!current.ok)
@@ -18373,22 +18480,22 @@ class TaskStore {
       let skipped = 0;
       const done = new Map;
       try {
-        fs7.mkdirSync(path6.join(legacy, "tasks"), { recursive: true });
+        fs8.mkdirSync(path8.join(legacy, "tasks"), { recursive: true });
         for (const name of ["workspace.json", "index.json"])
-          if (fs7.existsSync(path6.join(v2, name)))
-            fs7.copyFileSync(path6.join(v2, name), path6.join(legacy, name));
+          if (fs8.existsSync(path8.join(v2, name)))
+            fs8.copyFileSync(path8.join(v2, name), path8.join(legacy, name));
         for (const name of files) {
           const id = name.slice(0, -5);
-          const file = path6.join(v2Tasks, name);
-          const bytes = fs7.readFileSync(file, "utf8");
+          const file = path8.join(v2Tasks, name);
+          const bytes = fs8.readFileSync(file, "utf8");
           const digest = sha256(bytes);
-          fs7.writeFileSync(path6.join(legacy, "tasks", name), bytes);
+          fs8.writeFileSync(path8.join(legacy, "tasks", name), bytes);
           const parsed = this.parseRecord(bytes, taskRecordSchema, "2.x task");
           if (!parsed.ok || parsed.data.id !== id)
             return failure2("recovery_required", `cannot migrate 2.x task ${id}: ${parsed.ok ? "file name and record ID differ" : parsed.error}; move ${file} aside to continue`, { path: file });
           const record = { ...parsed.data, workspaceId: target.id };
-          const origin = { path: path6.join(legacy, "tasks", name), digest };
-          if (!fs7.existsSync(this.eventsPath(id))) {
+          const origin = { path: path8.join(legacy, "tasks", name), digest };
+          if (!fs8.existsSync(this.eventsPath(id))) {
             this.openTask(record, "migrated.from_v2", null, origin);
             migrated += 1;
           } else {
@@ -18423,8 +18530,8 @@ class TaskStore {
       try {
         let complete = true;
         for (const [name, digest] of done) {
-          const file = path6.join(v2Tasks, name);
-          if (sha256(fs7.readFileSync(file, "utf8")) !== digest) {
+          const file = path8.join(v2Tasks, name);
+          if (sha256(fs8.readFileSync(file, "utf8")) !== digest) {
             complete = false;
             continue;
           }
@@ -18434,7 +18541,7 @@ class TaskStore {
           return failure2("busy", `the 2.x store at ${v2} changed during migration; retry`, {
             path: v2
           });
-        fs7.rmSync(path6.join(v2, "index.json"), { force: true });
+        fs8.rmSync(path8.join(v2, "index.json"), { force: true });
         this.writeTombstone(v2, target.id);
       } catch (error) {
         return failure2("storage_error", `cannot finish the 2.x migration: ${String(error)}`, {
@@ -18454,45 +18561,45 @@ class TaskStore {
   }
   adoptLocalStore() {
     const dirs = this.paths();
-    const marker = path6.join(dirs.v2, "store.json");
-    if (!dirs.shared || !fs7.existsSync(marker))
+    const marker = path8.join(dirs.v2, "store.json");
+    if (!dirs.shared || !fs8.existsSync(marker))
       return success(null, null, null);
     return this.withLock(dirs.checkoutLock, () => {
-      if (!fs7.existsSync(marker))
+      if (!fs8.existsSync(marker))
         return success(null, null, null);
       let tasks = 0;
       try {
         const merge = (from, to) => {
-          if (!fs7.existsSync(to)) {
-            fs7.mkdirSync(path6.dirname(to), { recursive: true });
+          if (!fs8.existsSync(to)) {
+            fs8.mkdirSync(path8.dirname(to), { recursive: true });
             try {
-              fs7.renameSync(from, to);
+              fs8.renameSync(from, to);
             } catch {
-              fs7.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
-              fs7.rmSync(from, { recursive: true, force: true });
+              fs8.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
+              fs8.rmSync(from, { recursive: true, force: true });
             }
             return;
           }
-          if (fs7.lstatSync(from).isDirectory() && fs7.lstatSync(to).isDirectory())
-            for (const name of fs7.readdirSync(from))
-              merge(path6.join(from, name), path6.join(to, name));
+          if (fs8.lstatSync(from).isDirectory() && fs8.lstatSync(to).isDirectory())
+            for (const name of fs8.readdirSync(from))
+              merge(path8.join(from, name), path8.join(to, name));
         };
         for (const sub of ["tasks", "checkouts", "blobs", "legacy"]) {
-          const from = path6.join(dirs.v2, sub);
-          if (!fs7.existsSync(from))
+          const from = path8.join(dirs.v2, sub);
+          if (!fs8.existsSync(from))
             continue;
           if (sub === "tasks") {
-            for (const name of fs7.readdirSync(from))
-              if (validId(name) && !fs7.existsSync(path6.join(dirs.dir, sub, name)))
+            for (const name of fs8.readdirSync(from))
+              if (validId(name) && !fs8.existsSync(path8.join(dirs.dir, sub, name)))
                 tasks += 1;
           }
-          merge(from, path6.join(dirs.dir, sub));
+          merge(from, path8.join(dirs.dir, sub));
         }
-        const ledger = path6.join(dirs.v2, "ledger");
-        if (fs7.existsSync(ledger) && !fs7.existsSync(path6.join(dirs.dir, "ledger")))
-          merge(ledger, path6.join(dirs.dir, "ledger"));
-        fs7.rmSync(path6.join(dirs.v2, "task-index.json"), { force: true });
-        fs7.renameSync(marker, path6.join(dirs.v2, "store.moved.json"));
+        const ledger = path8.join(dirs.v2, "ledger");
+        if (fs8.existsSync(ledger) && !fs8.existsSync(path8.join(dirs.dir, "ledger")))
+          merge(ledger, path8.join(dirs.dir, "ledger"));
+        fs8.rmSync(path8.join(dirs.v2, "task-index.json"), { force: true });
+        fs8.renameSync(marker, path8.join(dirs.v2, "store.moved.json"));
       } catch (error) {
         return failure2("storage_error", `cannot move ${dirs.v2} into ${dirs.dir}: ${String(error)}`, {
           path: dirs.v2
@@ -18512,7 +18619,7 @@ class TaskStore {
   readV2Workspace(file) {
     let bytes;
     try {
-      bytes = fs7.readFileSync(file, "utf8");
+      bytes = fs8.readFileSync(file, "utf8");
     } catch {
       return null;
     }
@@ -18530,7 +18637,7 @@ class TaskStore {
       schemaVersion: SCHEMA_VERSION,
       id: workspaceId ?? newId(),
       revision: newRevision(),
-      root: path6.dirname(v2),
+      root: path8.dirname(v2),
       runtime: { createdWith: version, updatedWith: version },
       writer: null,
       store: {
@@ -18541,12 +18648,12 @@ class TaskStore {
       },
       critical: ["store"]
     };
-    fs7.mkdirSync(v2, { recursive: true });
-    const ignore = path6.join(v2, ".gitignore");
-    if (!fs7.existsSync(ignore))
-      fs7.writeFileSync(ignore, `*
+    fs8.mkdirSync(v2, { recursive: true });
+    const ignore = path8.join(v2, ".gitignore");
+    if (!fs8.existsSync(ignore))
+      fs8.writeFileSync(ignore, `*
 `);
-    replaceFile(path6.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
+    replaceFile(path8.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
 `, true);
   }
   stubFor(taskId) {
@@ -18562,7 +18669,7 @@ class TaskStore {
   }
   isStub(file) {
     try {
-      const value = JSON.parse(fs7.readFileSync(file, "utf8"));
+      const value = JSON.parse(fs8.readFileSync(file, "utf8"));
       return isObject5(value) && isObject5(value.store) && value.store.format === "workit-store";
     } catch {
       return false;
@@ -18570,32 +18677,32 @@ class TaskStore {
   }
   writeTombstoneIfMissing() {
     try {
-      const v2 = path6.join(this.root, ".workit");
-      if (fs7.existsSync(path6.join(v2, "workspace.json")))
+      const v2 = path8.join(this.root, ".workit");
+      if (fs8.existsSync(path8.join(v2, "workspace.json")))
         return;
       let id = null;
       try {
-        id = JSON.parse(fs7.readFileSync(this.paths().workspace, "utf8")).id ?? null;
+        id = JSON.parse(fs8.readFileSync(this.paths().workspace, "utf8")).id ?? null;
       } catch {}
       this.writeTombstone(v2, id);
     } catch {}
   }
   initializeStorage() {
     const dirs = this.paths();
-    retryTransient(() => fs7.mkdirSync(dirs.checkout, { recursive: true }));
-    retryTransient(() => fs7.mkdirSync(dirs.tasks, { recursive: true }));
-    if (!fs7.existsSync(dirs.marker))
+    retryTransient(() => fs8.mkdirSync(dirs.checkout, { recursive: true }));
+    retryTransient(() => fs8.mkdirSync(dirs.tasks, { recursive: true }));
+    if (!fs8.existsSync(dirs.marker))
       replaceFile(dirs.marker, `${JSON.stringify({ format: "workit-store", version: STORE_FORMAT, createdWith: runtimeVersion() })}
 `, false);
     if (!dirs.shared) {
-      const ignore = path6.join(dirs.dir, ".gitignore");
+      const ignore = path8.join(dirs.dir, ".gitignore");
       let current = null;
       try {
-        current = fs7.readFileSync(ignore, "utf8");
+        current = fs8.readFileSync(ignore, "utf8");
       } catch {}
       if (current !== `*
 `)
-        retryTransient(() => fs7.writeFileSync(ignore, `*
+        retryTransient(() => fs8.writeFileSync(ignore, `*
 `));
     }
     this.writeTombstoneIfMissing();
@@ -18611,7 +18718,7 @@ class TaskStore {
       shouldReclaim: ({ payload, nowMs }) => {
         let ageMs = null;
         try {
-          ageMs = nowMs - fs7.lstatSync(lockPath).mtimeMs;
+          ageMs = nowMs - fs8.lstatSync(lockPath).mtimeMs;
         } catch {}
         return classifyLockOwner(payload, ageMs, localLockHost(), TASK_STORE_LOCK).state === "stale";
       },
@@ -18648,7 +18755,7 @@ class TaskStore {
   withLock(lockPath, operation) {
     try {
       this.initializeStorage();
-      fs7.mkdirSync(path6.dirname(lockPath), { recursive: true });
+      fs8.mkdirSync(path8.dirname(lockPath), { recursive: true });
     } catch (error) {
       return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.paths().dir
@@ -18688,18 +18795,18 @@ class TaskStore {
   lockDirWritable(lockPath) {
     const probe = `${lockPath}.${process.pid}.${randomUUID3()}.probe`;
     try {
-      fs7.closeSync(fs7.openSync(probe, "wx", 384));
+      fs8.closeSync(fs8.openSync(probe, "wx", 384));
     } catch {
       return false;
     }
     try {
-      fs7.rmSync(probe, { force: true });
+      fs8.rmSync(probe, { force: true });
     } catch {}
     return true;
   }
   lockHolderPresent(lockPath) {
     try {
-      fs7.lstatSync(lockPath);
+      fs8.lstatSync(lockPath);
       return true;
     } catch (error) {
       return error?.code !== "ENOENT";
@@ -18711,12 +18818,12 @@ class TaskStore {
     if (isTransientWindowsError(error) && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
       return failure2("storage_error", `cannot create the workit lock (${code}); no other Workit call holds it`, {
         path: lockPath,
-        guidance: `Check permissions and the read-only attribute on ${path6.dirname(lockPath)}.`
+        guidance: `Check permissions and the read-only attribute on ${path8.dirname(lockPath)}.`
       });
     if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
       let lock = null;
       try {
-        lock = parseMetadataLockOrNull(fs7.readFileSync(lockPath, "utf8"));
+        lock = parseMetadataLockOrNull(fs8.readFileSync(lockPath, "utf8"));
       } catch {}
       return failure2("busy", `workit lock is held by another Workit call${lock ? ` (pid ${lock.pid} on ${lock.host})` : ""}; retry shortly`, {
         outcome: "not_started",
@@ -18734,15 +18841,15 @@ var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
 var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash9 } from "node:crypto";
-import * as fs12 from "node:fs";
+import { createHash as createHash10 } from "node:crypto";
+import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path14 from "node:path";
+import path16 from "node:path";
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import fs8 from "node:fs";
-import path7 from "node:path";
+import fs9 from "node:fs";
+import path9 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
 var CHECKS_FILE = "workit.checks.json";
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -18795,10 +18902,10 @@ var git = (cwd, args) => {
   return value || null;
 };
 function checkRoot(cwd) {
-  return path7.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+  return path9.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
 }
 var packageManager = (root) => {
-  const has = (file) => fs8.existsSync(path7.join(root, file));
+  const has = (file) => fs9.existsSync(path9.join(root, file));
   if (has("bun.lock") || has("bun.lockb"))
     return "bun";
   if (has("pnpm-lock.yaml"))
@@ -18818,7 +18925,7 @@ var CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
 function detectedChecks(root) {
   const read = (file) => {
     try {
-      return fs8.readFileSync(path7.join(root, file), "utf8");
+      return fs9.readFileSync(path9.join(root, file), "utf8");
     } catch {
       return null;
     }
@@ -18857,7 +18964,7 @@ function detectedChecks(root) {
 var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
-  const file = path7.join(root, CHECKS_FILE);
+  const file = path9.join(root, CHECKS_FILE);
   const none = (error = null) => ({
     source: error ? CHECKS_FILE : "none",
     root,
@@ -18867,7 +18974,7 @@ function loadCheckConfig(cwd) {
   });
   let text = null;
   try {
-    text = fs8.readFileSync(file, "utf8");
+    text = fs9.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
       return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
@@ -18930,10 +19037,10 @@ function workitAvailable(env = process.env) {
     return workitOnPath;
   const windows = process.platform === "win32";
   const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  const dirs = (env.PATH ?? env.Path ?? "").split(path7.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path9.delimiter).filter(Boolean);
   workitOnPath = dirs.some((dir) => exts.some((ext) => {
     try {
-      return fs8.statSync(path7.join(dir, `workit${ext}`)).isFile();
+      return fs9.statSync(path9.join(dir, `workit${ext}`)).isFile();
     } catch {
       return false;
     }
@@ -18946,10 +19053,10 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 // packages/workit-core/src/git/rev.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import fs9 from "node:fs";
+import { createHash as createHash6 } from "node:crypto";
+import fs10 from "node:fs";
 import os2 from "node:os";
-import path8 from "node:path";
+import path10 from "node:path";
 var MAX_BUFFER = 256 * 1024 * 1024;
 var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
 var git2 = (cwd, args, options = {}) => {
@@ -18984,10 +19091,10 @@ function headSha(cwd) {
 var emptyTree = (cwd) => line(git2(cwd, ["mktree"], { input: "" }));
 var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
 var seedIndex = (from, to) => {
-  fs9.copyFileSync(from, to);
-  const { atimeNs, mtimeNs } = fs9.statSync(from, { bigint: true });
+  fs10.copyFileSync(from, to);
+  const { atimeNs, mtimeNs } = fs10.statSync(from, { bigint: true });
   const seconds = (ns) => (Number(ns / 1000n) - 1) / 1e6;
-  fs9.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
+  fs10.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
 };
 function worktreeTree(cwd, options = {}) {
   const top = line(git2(cwd, ["rev-parse", "--show-toplevel"]));
@@ -18996,10 +19103,10 @@ function worktreeTree(cwd, options = {}) {
     return null;
   const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
   const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
-  const scratch = fs9.mkdtempSync(path8.join(os2.tmpdir(), "workit-tree-"));
+  const scratch = fs10.mkdtempSync(path10.join(os2.tmpdir(), "workit-tree-"));
   try {
-    const tempIndex = path8.join(scratch, "index");
-    if (fs9.existsSync(indexPath))
+    const tempIndex = path10.join(scratch, "index");
+    if (fs10.existsSync(indexPath))
       seedIndex(indexPath, tempIndex);
     const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
     const untracked = git2(top, ["ls-files", "--others", "--exclude-standard", "-z"], {
@@ -19011,7 +19118,7 @@ function worktreeTree(cwd, options = {}) {
     const skipped = [];
     for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
       try {
-        const stat = fs9.statSync(path8.join(top, file));
+        const stat = fs10.statSync(path10.join(top, file));
         if (stat.isFile() && stat.size > cap)
           skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
       } catch {}
@@ -19028,10 +19135,10 @@ function worktreeTree(cwd, options = {}) {
     if (!tree)
       return null;
     const base = line(git2(top, ["rev-parse", "--verify", "-q", "HEAD^{tree}"])) ?? emptyTree(top);
-    const key = skipped.length ? `sha256:${createHash5("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
+    const key = skipped.length ? `sha256:${createHash6("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
     return { tree, key, dirty: tree !== base || skipped.length > 0, skipped };
   } finally {
-    fs9.rmSync(scratch, { recursive: true, force: true });
+    fs10.rmSync(scratch, { recursive: true, force: true });
   }
 }
 function worktreeSignal(cwd, options = {}) {
@@ -19051,16 +19158,16 @@ function worktreeSignal(cwd, options = {}) {
   });
   if (!status.ok)
     return null;
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   hash.update(`${headSha(top) ?? "unborn"}\x00`);
   for (const entry of status.stdout.split("\x00")) {
     if (entry.length < 4)
       continue;
     const file = entry.slice(3);
-    const absolute = path8.join(top, file);
+    const absolute = path10.join(top, file);
     let stat = "-";
     try {
-      const info = fs9.lstatSync(absolute, { bigint: true });
+      const info = fs10.lstatSync(absolute, { bigint: true });
       stat = `${info.mode.toString(8)}:${info.size}:${info.mtimeNs}`;
       if (info.isDirectory())
         stat += `:${headSha(absolute) ?? "-"}`;
@@ -19127,17 +19234,17 @@ function pushRemoteName(cwd, branch) {
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path13 from "node:path";
+import path15 from "node:path";
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash8, randomBytes as randomBytes2 } from "node:crypto";
-import fs11 from "node:fs";
-import path12 from "node:path";
+import { createHash as createHash9, randomBytes as randomBytes3 } from "node:crypto";
+import fs12 from "node:fs";
+import path14 from "node:path";
 // packages/workit-core/src/core/vcs-config.ts
-import fs10 from "node:fs";
-import path11 from "node:path";
+import fs11 from "node:fs";
+import path13 from "node:path";
 import { spawnSync as spawnSync8 } from "node:child_process";
 // packages/workit-core/src/core/config.ts
@@ -19151,7 +19258,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import os3 from "node:os";
-import path9 from "node:path";
+import path11 from "node:path";
 // packages/workit-core/src/core/boundary.ts
 import { statSync as statSync2 } from "node:fs";
@@ -19210,7 +19317,7 @@ var mergePreset = (preset, input = {}, current = {
     protected: preset === "custom" ? input.protectedNames ?? current.branchPolicy.protected : [...defs.protected]
   };
 };
-var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path9.join(process.env.XDG_CONFIG_HOME || path9.join(os3.homedir(), ".config"), "workit");
+var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path11.join(process.env.XDG_CONFIG_HOME || path11.join(os3.homedir(), ".config"), "workit");
 var migratedDir = null;
 var migrationFailed = false;
 var ensureConfigDir = (dir = resolveConfigDir()) => {
@@ -19220,7 +19327,7 @@ var ensureConfigDir = (dir = resolveConfigDir()) => {
     migratedDir = dir;
     return dir;
   }
-  const legacy = path9.join(process.env.XDG_CONFIG_HOME || path9.join(os3.homedir(), ".config"), "workflow-toolkit");
+  const legacy = path11.join(process.env.XDG_CONFIG_HOME || path11.join(os3.homedir(), ".config"), "workflow-toolkit");
   if (!existsSync3(legacy)) {
     migratedDir = dir;
     return dir;
@@ -19233,8 +19340,8 @@ var ensureConfigDir = (dir = resolveConfigDir()) => {
   mkdirSync2(dir, { recursive: true });
   diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
   for (const entry of readdirSync2(legacy, { withFileTypes: true })) {
-    const src = path9.join(legacy, entry.name);
-    const dest = path9.join(dir, entry.name);
+    const src = path11.join(legacy, entry.name);
+    const dest = path11.join(dir, entry.name);
     if (existsSync3(dest))
       continue;
     try {
@@ -19306,7 +19413,7 @@ var parseConfigResult = (raw, file) => {
   return { status: "valid", path: file, config };
 };
 var readConfigTyped = (dir) => {
-  const file = path9.join(dir ?? configDir(), "config.json");
+  const file = path11.join(dir ?? configDir(), "config.json");
   return parseConfigResult(readSafe(file), file);
 };
 var readConfig = () => {
@@ -19315,7 +19422,7 @@ var readConfig = () => {
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
 };
-var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path9.join(configDir(), "vcs.json");
+var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path11.join(configDir(), "vcs.json");
 var branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i");
 var resolveBranchPolicy = (config, workspace, repoPreset) => {
   const wp = workspace?.branchPolicy ?? {};
@@ -19347,9 +19454,9 @@ var COMMIT_PRESETS = [
 // packages/workit-core/src/core/workspaces.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
-import path10 from "node:path";
+import path12 from "node:path";
 // packages/workit-core/src/core/branch-policy.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
@@ -19474,7 +19581,7 @@ var releaseTrackSchema = object({
       context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
     }
   }
-  if (track.versionSource?.kind === "package-json" && (path10.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+  if (track.versionSource?.kind === "package-json" && (path12.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
     context.addIssue({
       code: "custom",
       path: ["versionSource", "path"],
@@ -19535,7 +19642,7 @@ var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).opt
     names.add(workspace.name);
   }
 });
-var workspacesRevision = (contents) => createHash6("sha256").update(contents ?? "<missing>").digest("hex");
+var workspacesRevision = (contents) => createHash7("sha256").update(contents ?? "<missing>").digest("hex");
 var validateWorkspacesDocument = (parsed, file) => {
   if (!isConfigObject(parsed)) {
     return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
@@ -19573,7 +19680,7 @@ var validateWorkspacesDocument = (parsed, file) => {
   };
 };
 var readWorkspacesResult = (dir = configDir()) => {
-  const file = path10.join(dir, "workspaces.json");
+  const file = path12.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -19684,9 +19791,9 @@ var mainCheckoutOf = (cwd) => {
   let main = null;
   const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
   const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
-  if (gitDir && common && path10.resolve(gitDir) !== path10.resolve(common)) {
+  if (gitDir && common && path12.resolve(gitDir) !== path12.resolve(common)) {
     const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
-    main = listed?.trim() || (path10.basename(common) === ".git" ? path10.dirname(common) : common);
+    main = listed?.trim() || (path12.basename(common) === ".git" ? path12.dirname(common) : common);
   }
   mainCheckouts.set(cwd, main);
   return main;
@@ -19777,7 +19884,7 @@ var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
 var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
-  const file = path10.join(dir, "workspaces.json");
+  const file = path12.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -19852,7 +19959,7 @@ function workspaceDefaultTarget(cwd, globalDefault) {
 }
 // packages/workit-core/src/core/release-tracks.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { spawnSync as spawnSync7 } from "node:child_process";
 var KNOWN_FIELDS = new Set([
   "strategy",
@@ -20222,7 +20329,7 @@ function resolveTrackFor(cwd, options) {
       ]) ?? "",
       git3(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
     ] : [];
-    key = createHash7("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
+    key = createHash8("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
     const hit = memo2.get(key);
     if (hit)
       return hit;
@@ -20237,7 +20344,7 @@ function resolveTrackFor(cwd, options) {
 }
 // packages/workit-core/src/core/vcs-config.ts
-var workspacesPath = () => path11.join(configDir(), "workspaces.json");
+var workspacesPath = () => path13.join(configDir(), "workspaces.json");
 var vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
 var remoteProvider = (cwd) => {
   const r = spawnSync8("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
@@ -20327,7 +20434,7 @@ var readVcsConfig = () => {
   const file = vcsConfigPath();
   let raw;
   try {
-    raw = fs10.readFileSync(file, "utf8");
+    raw = fs11.readFileSync(file, "utf8");
   } catch {
     return { status: "missing", path: file, config: {} };
   }
@@ -20412,7 +20519,7 @@ function vcsConfig(mode, cwd, options = {}) {
   const prov = cfg[provider] ?? {};
   const out = {
     ok: true,
-    configPath: path11.resolve(cfgPath),
+    configPath: path13.resolve(cfgPath),
     provider,
     defaultTargetBranch: workspaceDefault,
     pr: cfg.pr ?? {},
@@ -20623,7 +20730,7 @@ function diffHash(cwd, base, head) {
   ], GIT_TIMEOUTS.worktree);
   if (!diff.ok || !diff.stdout)
     return null;
-  const hash = createHash8("sha256");
+  const hash = createHash9("sha256");
   for (const line of diff.stdout.split(`
 `)) {
     if (line.startsWith("index "))
@@ -20635,16 +20742,16 @@ function diffHash(cwd, base, head) {
   return `sha256:${hash.digest("hex")}`;
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path12.resolve(cwd));
+  const location = resolveStore(path14.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path12.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path14.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
-var newId2 = () => `${Date.now().toString(36)}-${randomBytes2(6).toString("hex")}`;
+var newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`;
 var NETWORK_FS_TYPES = new Set([
   26985,
   20859,
@@ -20662,7 +20769,7 @@ var onNetworkFs = (dir) => {
   if (process.platform !== "linux")
     return false;
   try {
-    return isNetworkFsType(fs11.statfsSync(dir).type);
+    return isNetworkFsType(fs12.statfsSync(dir).type);
   } catch {
     return false;
   }
@@ -20672,15 +20779,15 @@ var LOCK_STALE_MS = 30000;
 var LOCK_OWNER = "owner";
 var lockToken = (lock) => {
   try {
-    return fs11.readFileSync(path12.join(lock, LOCK_OWNER), "utf8");
+    return fs12.readFileSync(path14.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 };
 var lockAgeMs = (lock) => {
-  for (const target of [path12.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path14.join(lock, LOCK_OWNER), lock]) {
     try {
-      return Date.now() - fs11.statSync(target).mtimeMs;
+      return Date.now() - fs12.statSync(target).mtimeMs;
     } catch {}
   }
   return null;
@@ -20688,55 +20795,55 @@ var lockAgeMs = (lock) => {
 var ledgerLock = {
   acquire(lock) {
     try {
-      fs11.mkdirSync(lock);
+      fs12.mkdirSync(lock);
     } catch (error) {
       if (error.code === "EEXIST")
         return null;
       throw error;
     }
-    const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
-    fs11.writeFileSync(path12.join(lock, LOCK_OWNER), token);
+    const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
+    fs12.writeFileSync(path14.join(lock, LOCK_OWNER), token);
     return token;
   },
   release(lock, token) {
     if (lockToken(lock) !== token)
       return false;
-    const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
+    const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
     try {
-      fs11.renameSync(lock, tomb);
+      fs12.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) !== token) {
       try {
-        fs11.renameSync(tomb, lock);
+        fs12.renameSync(tomb, lock);
       } catch {}
       return false;
     }
-    fs11.rmSync(tomb, { recursive: true, force: true });
+    fs12.rmSync(tomb, { recursive: true, force: true });
     return true;
   },
   token: lockToken,
   reap(lock, observed) {
-    const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
+    const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
     try {
-      fs11.renameSync(lock, tomb);
+      fs12.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) === observed) {
-      fs11.rmSync(tomb, { recursive: true, force: true });
+      fs12.rmSync(tomb, { recursive: true, force: true });
       return true;
     }
     try {
-      fs11.renameSync(tomb, lock);
+      fs12.renameSync(tomb, lock);
     } catch {
-      fs11.rmSync(tomb, { recursive: true, force: true });
+      fs12.rmSync(tomb, { recursive: true, force: true });
     }
     return false;
   }
 };
-function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
+function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
   const lock = `${file}.lock`;
   const deadline = Date.now() + waitMs;
   let token = null;
@@ -20758,14 +20865,14 @@ function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
     ledgerLock.release(lock, token);
   }
 }
-var sha2562 = (text) => createHash8("sha256").update(text).digest("hex");
+var sha2562 = (text) => createHash9("sha256").update(text).digest("hex");
 var chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
 ${body}`);
 var TAIL_BYTES = 64 * 1024;
 var lastLine = (fd, size) => {
   for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
     const buffer = Buffer.alloc(span);
-    fs11.readSync(fd, buffer, 0, span, size - span);
+    fs12.readSync(fd, buffer, 0, span, size - span);
     const end = buffer.lastIndexOf(10);
     if (end < 0) {
       if (span === size)
@@ -20794,15 +20901,23 @@ var lastLine = (fd, size) => {
   }
   return null;
 };
+var tighten = (fd) => {
+  try {
+    if ((fs12.fstatSync(fd).mode & 63) !== 0)
+      fs12.fchmodSync(fd, 384);
+  } catch {}
+};
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs11.openSync(file, "a+");
+    const fd = fs12.openSync(file, "a+", 384);
     try {
-      const size = fs11.fstatSync(fd).size;
+      if (process.platform !== "win32")
+        tighten(fd);
+      const size = fs12.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
         const last = Buffer.alloc(1);
-        fs11.readSync(fd, last, 0, 1, size - 1);
+        fs12.readSync(fd, last, 0, 1, size - 1);
         if (last[0] !== 10)
           fence = `
 `;
@@ -20811,17 +20926,17 @@ function appendLine(file, build, options) {
       if (!line.ok)
         return line;
       const bytes = Buffer.from(fence + line.value);
-      const written = fs11.writeSync(fd, bytes);
+      const written = fs12.writeSync(fd, bytes);
       if (written !== bytes.length)
         return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
       return { ok: true, value: undefined };
     } finally {
-      fs11.closeSync(fd);
+      fs12.closeSync(fd);
     }
   };
   try {
-    fs11.mkdirSync(path12.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path12.dirname(file)))
+    fs12.mkdirSync(path14.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path14.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -20889,8 +21004,10 @@ function readLedger(cwd, options = {}) {
   if (!file.ok)
     return file;
   let text = "";
+  let stat = null;
   try {
-    text = fs11.readFileSync(file.value, "utf8");
+    stat = fs12.statSync(file.value);
+    text = fs12.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return {
@@ -20909,6 +21026,7 @@ function readLedger(cwd, options = {}) {
   const integrity = { chained: 0, legacy: 0, unverified: [] };
   const earlier = new Set([null]);
   let chainStarted = false;
+  const ids = new Set;
   for (const raw of text.split(`
 `)) {
     const trimmed = raw.trim();
@@ -20942,6 +21060,10 @@ function readLedger(cwd, options = {}) {
       reason = "unsigned";
     else
       rowIntegrity = "legacy";
+    if (options.integrity && !reason && ids.has(parsed.id))
+      reason = "duplicate_id";
+    if (options.integrity)
+      ids.add(parsed.id);
     if (reason)
       rowIntegrity = "unverified";
     const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
@@ -20965,7 +21087,8 @@ function readLedger(cwd, options = {}) {
       seq: rows.length + 1,
       superseded: false,
       supersedeIgnored: false,
-      ...rowIntegrity ? { integrity: rowIntegrity } : {}
+      ...rowIntegrity ? { integrity: rowIntegrity } : {},
+      ...reason ? { integrityReason: reason } : {}
     };
     rows.push(row);
     if (!options.integrity)
@@ -20993,18 +21116,48 @@ function readLedger(cwd, options = {}) {
   const byId = new Map;
   for (const row of rows) {
     const target = row.supersedes ? byId.get(row.supersedes) : undefined;
-    if (target && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
+    if (target && row.integrity !== "unverified" && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
       target.superseded = true;
     else if (row.supersedes)
       row.supersedeIgnored = true;
     if (!byId.has(row.id))
       byId.set(row.id, row);
   }
+  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
+    tamperCache.set(file.value, {
+      size: stat.size,
+      stamp: fileStamp(stat),
+      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason))
+    });
   return {
     ok: true,
     value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
   };
 }
+var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+var tamperCache = new Map;
+var fileStamp = (stat) => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`;
+function ledgerTampering(cwd) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return [];
+  try {
+    const stat = fs12.statSync(file.value);
+    const cached = tamperCache.get(file.value);
+    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
+      return cached.breaks;
+  } catch {
+    return [];
+  }
+  const read = readLedger(cwd, { integrity: true });
+  return read.ok ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason)) : [];
+}
+function tamperedUnblock(cwd) {
+  const file = ledgerPath(cwd);
+  const where = file.ok ? file.value : "the ledger file";
+  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
+}
+var tamperedWarning = (cwd, breaks) => `the ledger was edited, or a row was removed or moved (${breaks.slice(0, 3).map((row) => `${row.reason} at row ${row.seq}`).join(", ")}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`;
 function verdictBasis(verdict, current) {
   if (verdict.head && verdict.head === current.head)
     return "fresh";
@@ -21012,7 +21165,7 @@ function verdictBasis(verdict, current) {
     return "carried";
   return "stale";
 }
-var isLiveVerdict = (row) => row.type === "verdict" && typeof row.result === "string" && !row.superseded;
+var isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id);
 function trailerSessions(cwd, base, head) {
   if (!base || !head || !safeRef(base) || !safeRef(head))
     return [];
@@ -21093,6 +21246,56 @@ var authoredBy = (authors, session) => {
       return true;
   return false;
 };
+var TRUST_REASONS = new Set([
+  "unsigned",
+  "hash_mismatch",
+  "broken_link",
+  "duplicate_id",
+  "unissued_session",
+  "unbound_session"
+]);
+var SHELL_VOUCHED_HOSTS = new Set([
+  "cli",
+  "opencode",
+  "pi",
+  "codex_cli",
+  "codex_desktop"
+]);
+function sessionTrust(cwd, row) {
+  const session = row.actor.session;
+  if (!session || row.self === true)
+    return null;
+  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
+  const host = row.actor.host;
+  const issuedOnly = source === "flag" ? host !== "cli" : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
+  if (!issuedOnly)
+    return null;
+  const binding = issuedBinding(cwd, session);
+  if (binding === null)
+    return "unissued_session";
+  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
+}
+function trustReasons(cwd, row) {
+  if (row.integrity === "unverified")
+    return [row.integrityReason ?? "unsigned"];
+  if (row.integrity !== "verified")
+    return ["unsigned"];
+  const session = sessionTrust(cwd, row);
+  return session ? [session] : [];
+}
+function withIntegrity(cwd, rows) {
+  if (rows.every((row) => row.integrity !== undefined))
+    return rows;
+  const read = readLedger(cwd, { integrity: true });
+  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
+  return rows.map((row) => {
+    if (row.integrity !== undefined)
+      return row;
+    const fresh = bySeq.get(row.seq);
+    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+  });
+}
+var untrusted = (reasons) => reasons.some((reason) => TRUST_REASONS.has(reason));
 var independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
@@ -21103,15 +21306,17 @@ var independenceReasons = (row, authors) => {
     reasons.push("self");
   return reasons;
 };
-function effectiveOf(rows, authors, sameCode, isCurrent) {
+function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
   let effective = null;
   for (const row of rows) {
     if (!effective) {
       effective = row;
       continue;
     }
-    const rowIndependent = independenceReasons(row, authors).length === 0;
-    const effIndependent = independenceReasons(effective, authors).length === 0;
+    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective)))
+      continue;
+    const rowIndependent = reasonsOf(row).length === 0;
+    const effIndependent = reasonsOf(effective).length === 0;
     if (effIndependent && !rowIndependent && isCurrent(effective))
       continue;
     if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
@@ -21125,7 +21330,7 @@ function restackCarries(rows, branch, from, to) {
     return false;
   const edges = new Map;
   for (const row of rows)
-    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
       edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
   const seen = new Set([from]);
   const queue = [from];
@@ -21141,7 +21346,8 @@ function restackCarries(rows, branch, from, to) {
   }
   return false;
 }
-function checkVerdicts(cwd, branch, rows) {
+function checkVerdicts(cwd, branch, ledgerRows) {
+  const rows = withIntegrity(cwd, ledgerRows);
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const scope = branchScope(cwd, branch);
@@ -21171,21 +21377,47 @@ function checkVerdicts(cwd, branch, rows) {
     return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
+  const failureAuthorCache = new Map;
+  const failureAuthors = (row) => {
+    let set = failureAuthorCache.get(row.seq);
+    if (!set) {
+      set = authorSessions(cwd, rows.filter((other) => other.integrity === "verified" && other.seq < row.seq), branch, { base: null, head: null }, scope);
+      failureAuthorCache.set(row.seq, set);
+    }
+    return set;
+  };
+  const reasonCache = new Map;
+  const reasonsOf = (row) => {
+    let reasons = reasonCache.get(row);
+    if (!reasons) {
+      const failing = FAILING.has(String(row.result));
+      reasons = [
+        ...trustReasons(cwd, row),
+        ...independenceReasons(row, failing ? failureAuthors(row) : authors)
+      ];
+      reasonCache.set(row, reasons);
+    }
+    return reasons;
+  };
+  const retired = new Set;
+  for (const row of rows)
+    if (row.type === "verdict" && row.supersedes && !row.supersedeIgnored && trustReasons(cwd, row).length === 0)
+      retired.add(row.supersedes);
   const byKind = new Map;
   for (const row of rows)
-    if (isLiveVerdict(row) && scope(row)) {
+    if (isLiveVerdict(row, retired) && scope(row)) {
       const kind = typeof row.kind === "string" ? row.kind : "review";
       byKind.set(kind, [...byKind.get(kind) ?? [], row]);
     }
   const verdicts = [];
   const warnings = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors, sameCode, (candidate) => basisOf(candidate) !== "stale");
+    const row = effectiveOf(list, reasonsOf, sameCode, (candidate) => basisOf(candidate) !== "stale");
     if (!row)
       continue;
     const basis = basisOf(row);
     const current = basis !== "stale";
-    const independence = independenceReasons(row, authors);
+    const independence = reasonsOf(row);
     const reasons = [
       ...current ? [] : ["stale"],
       ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
@@ -21202,23 +21434,31 @@ function checkVerdicts(cwd, branch, rows) {
     });
     if (reasons.length === 0) {
       for (const later of list)
-        if (later.seq > row.seq && independenceReasons(later, authors).length > 0 && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
+        if (later.seq > row.seq && reasonsOf(later).length > 0 && !untrusted(reasonsOf(later)) && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
           warnings.push(`the author's own (self) ${String(later.result)} ${kind} verdict ${later.id} by ${later.actor.session ?? "no session"} on the current code is newer than the accepted pass ${row.id}: read it before merging`);
     }
   }
   for (const row of rows)
     if (row.integrity === "unverified" && scope(row))
       warnings.push(`ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`);
+  const tampered = ledgerTampering(cwd);
+  if (tampered.length) {
+    warnings.push(tamperedWarning(cwd, tampered));
+    for (const entry of verdicts) {
+      entry.accepted = false;
+      entry.reasons = [...entry.reasons, "ledger_tampered"];
+    }
+  }
   verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
-  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
   return {
     branch,
     head,
@@ -21381,7 +21621,7 @@ var productDecision = (task, ledger) => {
   };
 };
 var planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path13.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path15.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -21429,15 +21669,15 @@ function derivedRuleStatus(task, requirement, root, ledger) {
 }
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes = (value) => createHash9("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path14.sep}`);
-var relative = (root, candidate) => path14.relative(root, candidate).split(path14.sep).join("/") || ".";
+var digestBytes = (value) => createHash10("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path16.sep}`);
+var relative = (root, candidate) => path16.relative(root, candidate).split(path16.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path14.posix.normalize(value);
+  const normalized = path16.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -21485,21 +21725,21 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path14.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path14.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
 var walk = (root, directory, output) => {
   let names;
   try {
-    names = fs12.readdirSync(directory);
+    names = fs13.readdirSync(directory);
   } catch {
     return true;
   }
@@ -21507,10 +21747,10 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path14.join(directory, name);
+    const target = path16.join(directory, name);
     let stat;
     try {
-      stat = fs12.lstatSync(target);
+      stat = fs13.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -21525,14 +21765,14 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path14.resolve(root, item);
+    const target = path16.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs12.existsSync(ancestor) && ancestor !== root)
-      ancestor = path14.dirname(ancestor);
+    while (!fs13.existsSync(ancestor) && ancestor !== root)
+      ancestor = path16.dirname(ancestor);
     try {
-      if (!inside(root, fs12.realpathSync(ancestor)))
+      if (!inside(root, fs13.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -21544,7 +21784,7 @@ var scopeRoots = (root, scope) => {
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs12.realpathSync(root);
+    checkout = fs13.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -21562,11 +21802,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs12.existsSync(target))
+    if (!fs13.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs12.lstatSync(target);
+      stat = fs13.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -21582,17 +21822,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path14.join(checkout, item);
+    const target = path16.join(checkout, item);
     try {
-      const stat = fs12.lstatSync(target);
+      const stat = fs13.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs12.readlinkSync(target);
+        const link = fs13.readlinkSync(target);
         files.push({ path: item, kind: "symlink", digest: digestBytes(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes(fs12.readFileSync(target)),
+          digest: digestBytes(fs13.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -21757,7 +21997,7 @@ var findingVerificationPasses = (findingCandidateId, evidence) => evidence.statu
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
-    root = fs12.realpathSync(checkoutRoot);
+    root = fs13.realpathSync(checkoutRoot);
   } catch {
     return failure2("permission_denied", "checkout root is unavailable");
   }
@@ -21766,23 +22006,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path14.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path14.sep}`))
+    const target = path16.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path16.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path14.relative(root, target);
+      const below = path16.relative(root, target);
       let current = root;
-      for (const segment of below.split(path14.sep)) {
+      for (const segment of below.split(path16.sep)) {
         if (!segment)
           continue;
-        current = path14.join(current, segment);
-        const stat = fs12.lstatSync(current);
-        const real = fs12.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path14.sep}`))
+        current = path16.join(current, segment);
+        const stat = fs13.lstatSync(current);
+        const real = fs13.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path16.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -21798,7 +22038,7 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
         if (current !== target && !stat.isDirectory())
           return failure2("invalid_input", "document reference ancestor is not a directory");
       }
-      if (digestBytes(fs12.readFileSync(target)) !== reference.digest)
+      if (digestBytes(fs13.readFileSync(target)) !== reference.digest)
         return failure2("permission_denied", "decision document bytes have changed");
     } catch {
       return failure2("invalid_input", "decision document is unavailable");
@@ -22656,7 +22896,7 @@ var judgeInputSummary = (raw) => {
 // packages/workit-core/src/autonomy.ts
 import os4 from "node:os";
-import path15 from "node:path";
+import path17 from "node:path";
 var accountHome = () => {
   try {
     return os4.userInfo().homedir;
@@ -22665,10 +22905,10 @@ var accountHome = () => {
   }
 };
 var grantsHome = { resolve: accountHome };
-var grantsDir = () => path15.join(grantsHome.resolve(), ".config", "workit");
+var grantsDir = () => path17.join(grantsHome.resolve(), ".config", "workit");
 var grantsOverride = () => {
-  const configured = path15.resolve(resolveConfigDir());
-  return configured === path15.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path15.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+  const configured = path17.resolve(resolveConfigDir());
+  return configured === path17.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path17.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 };
 var GRANT_KINDS = ["push", "pr", "merge", "release", "rerun"];
 var DEFAULT_GRANTS = Object.freeze({
@@ -24440,7 +24680,7 @@ class WorkitCore {
 // packages/workit-core/src/core/repo-context.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "node:fs";
-import path16 from "node:path";
+import path18 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -24574,7 +24814,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path16.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path18.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -24605,7 +24845,7 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path16.join(cwd, "package.json");
+  const pkgPath = path18.join(cwd, "package.json");
   if (!existsSync6(pkgPath))
     return [];
   try {
@@ -24631,9 +24871,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path16.join(dir, entry.name), depth + 1);
+        walk(path18.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path16.relative(cwd, path16.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path18.relative(cwd, path18.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -24649,7 +24889,7 @@ var readTrimmed2 = (file, maxLines) => {
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path16.resolve(repoRoot(root));
+  const cwd = path18.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -24707,7 +24947,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 `;
-    stdout += readTrimmed2(path16.join(cwd, template), 220);
+    stdout += readTrimmed2(path18.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
@@ -24717,7 +24957,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync6(path16.join(cwd, "package.json"))) {
+  if (existsSync6(path18.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -24726,7 +24966,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync6(path16.join(cwd, "Cargo.toml")) || existsSync6(path16.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync6(path18.join(cwd, "Cargo.toml")) || existsSync6(path18.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -24759,7 +24999,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the host-native editor, preserving the repository changelog conventions.
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path16.resolve(repoRoot(root));
+  const cwd = path18.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -24777,7 +25017,7 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path16.join(cwd, "CHANGELOG.md");
+  const changelogPath = path18.join(cwd, "CHANGELOG.md");
   if (existsSync6(changelogPath)) {
     stdout += readTrimmed2(changelogPath, 260) + `
 `;
@@ -24797,7 +25037,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path16.resolve(repoRoot(root));
+  const cwd = path18.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -24819,7 +25059,7 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path16.join(cwd, "README.md");
+  const readme = path18.join(cwd, "README.md");
   if (existsSync6(readme)) {
     stdout += readTrimmed2(readme, 220) + `
 `;
@@ -24828,7 +25068,7 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path16.join(cwd, "package.json");
+  const pkgPath = path18.join(cwd, "package.json");
   if (existsSync6(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
@@ -24842,7 +25082,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path16.resolve(repoRoot(root));
+  const cwd = path18.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -24880,7 +25120,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync6(path16.join(cwd, rel)))
+    if (existsSync6(path18.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -24911,8 +25151,8 @@ function releaseNotesContext(root, rangeOrTag) {
 import { spawnSync as spawnSync13 } from "node:child_process";
 // packages/workit-core/src/core/pr-create.ts
-import fs13 from "node:fs";
-import path17 from "node:path";
+import fs14 from "node:fs";
+import path19 from "node:path";
 import { spawnSync as spawnSync12 } from "node:child_process";
 // packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
@@ -24923,13 +25163,13 @@ function parseGhIssue(value) {
 // packages/workit-core/src/core/pr-create.ts
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path17.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path19.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path17.join(dir, name);
+      const candidate = path19.join(dir, name);
       try {
-        fs13.accessSync(candidate, fs13.constants.X_OK);
+        fs14.accessSync(candidate, fs14.constants.X_OK);
         return candidate;
       } catch {}
     }
@@ -25047,8 +25287,8 @@ var fetchGitLabIssueBody = async (ref, root, deps = {}) => {
 };
 // packages/workit-core/src/core/youtrack.ts
-import fs14 from "node:fs";
-import path18 from "node:path";
+import fs15 from "node:fs";
+import path20 from "node:path";
 // packages/workit-core/src/core/templates.ts
 var repoRoot2 = assetRoot();
@@ -25061,22 +25301,22 @@ var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
 var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path18.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path18.join(resolveConfigDir(), "youtrack.json");
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path20.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path20.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
-  const mode = fs14.statSync(p).mode & 511;
+  const mode = fs15.statSync(p).mode & 511;
   return mode === 384;
 };
 function readYouTrackConfig(required) {
   const cfgPath = youTrackConfigPath();
-  if (!fs14.existsSync(cfgPath)) {
+  if (!fs15.existsSync(cfgPath)) {
     return required ? { error: "ERROR: missing youtrack.json", path: cfgPath } : { config: {}, path: cfgPath };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs14.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs15.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: `${cfgPath} is not valid JSON`, path: cfgPath };
   }
@@ -25087,11 +25327,11 @@ function readYouTrackConfig(required) {
 }
 var readYouTrackContextConfig = () => {
   const cfgPath = youTrackReadOnlyConfigPath();
-  if (!fs14.existsSync(cfgPath))
+  if (!fs15.existsSync(cfgPath))
     return { data: {} };
   let parsed;
   try {
-    parsed = JSON.parse(fs14.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs15.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: "YouTrack configuration is unavailable" };
   }
@@ -25130,12 +25370,12 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path18.isAbsolute(tokenFile) ? path18.resolve(tokenFile) : path18.resolve(process.cwd(), tokenFile) : "";
-  if (!tokenPath || !fs14.existsSync(tokenPath))
+  const tokenPath = tokenFile ? path20.isAbsolute(tokenFile) ? path20.resolve(tokenFile) : path20.resolve(process.cwd(), tokenFile) : "";
+  if (!tokenPath || !fs15.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
     return { error: "youtrack.token mode must be 0600" };
-  const token = fs14.readFileSync(tokenPath, "utf8").trim();
+  const token = fs15.readFileSync(tokenPath, "utf8").trim();
   if (!token)
     return { error: "empty token file" };
   if (token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER)) {
@@ -25200,9 +25440,9 @@ function resolveYouTrackFromPaths(spec_path, plan_path, workspace_root) {
     } catch {
       continue;
     }
-    if (!fs14.existsSync(full))
+    if (!fs15.existsSync(full))
       continue;
-    const text = fs14.readFileSync(full, "utf8");
+    const text = fs15.readFileSync(full, "utf8");
     const m = text.match(/^\*\*YouTrack:\*\*\s*`?([A-Z]+-\d+)`?/m);
     if (m)
       return m[1];
@@ -25472,15 +25712,15 @@ function resolveGitRevision(root, value) {
 }
 function resolveInside(root, candidate) {
   const base = realpathSync5(root);
-  const target = path19.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path19.sep)) {
+  const target = path21.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path21.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
   while (!existsSync7(ancestor))
-    ancestor = path19.dirname(ancestor);
+    ancestor = path21.dirname(ancestor);
   const canonicalAncestor = realpathSync5(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path19.sep)) {
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path21.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
@@ -25512,7 +25752,7 @@ var SUPPORT_MATRIX = {
 // packages/workit-mcp/src/server.ts
 import { existsSync as existsSync8, readFileSync as readFileSync6, realpathSync as realpathSync6 } from "node:fs";
-import path20 from "node:path";
+import path22 from "node:path";
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
@@ -27926,13 +28166,13 @@ var rootVariants = (workspaceRoot) => {
   if (!workspaceRoot)
     return [];
   const roots = new Set;
-  for (const candidate of [workspaceRoot, path20.resolve(workspaceRoot)]) {
-    if (path20.isAbsolute(candidate) && candidate !== path20.parse(candidate).root)
+  for (const candidate of [workspaceRoot, path22.resolve(workspaceRoot)]) {
+    if (path22.isAbsolute(candidate) && candidate !== path22.parse(candidate).root)
       roots.add(candidate);
   }
   try {
     const canonical = realpathSync6(workspaceRoot);
-    if (canonical !== path20.parse(canonical).root)
+    if (canonical !== path22.parse(canonical).root)
       roots.add(canonical);
   } catch {}
   return [...roots].toSorted((left, right) => right.length - left.length);
@@ -28014,11 +28254,11 @@ var thrownResult = (tool, error, workspaceRoot) => {
 };
 function createMcpServer(host, contextProvider) {
   assertMcpHost(host);
-  const here = path20.dirname(fileURLToPath2(import.meta.url));
+  const here = path22.dirname(fileURLToPath2(import.meta.url));
   const sourceMarker = markSourcesLoaded([
-    path20.join(here, "server.ts"),
-    path20.join(here, "..", "..", "workit-core", "src", "core", "task-contract.ts"),
-    path20.join(here, "..", "..", "workit-core", "src", "core", "task-engine.ts")
+    path22.join(here, "server.ts"),
+    path22.join(here, "..", "..", "workit-core", "src", "core", "task-contract.ts"),
+    path22.join(here, "..", "..", "workit-core", "src", "core", "task-engine.ts")
   ].filter((file) => existsSync8(file)));
   let staleWarned = false;
   const server = new Server({ name: "workit", version: VERSION }, { capabilities: { tools: {}, resources: {} } });
@@ -28401,14 +28641,14 @@ import {
   writeFileSync as writeFileSync3
 } from "node:fs";
 import os5 from "node:os";
-import path21 from "node:path";
+import path23 from "node:path";
 var CODEX_AGENT_MARKER = "# Generated by Workit";
 var codexHomeOfInstall = (pluginRoot) => {
-  const parts = path21.resolve(pluginRoot).split(path21.sep);
+  const parts = path23.resolve(pluginRoot).split(path23.sep);
   const cache = parts.length - 4;
-  return cache >= 2 && parts[cache] === "cache" && parts[cache - 1] === "plugins" ? parts.slice(0, cache - 1).join(path21.sep) || path21.sep : null;
+  return cache >= 2 && parts[cache] === "cache" && parts[cache - 1] === "plugins" ? parts.slice(0, cache - 1).join(path23.sep) || path23.sep : null;
 };
-var codexHomeFor = (pluginRoot, env) => codexHomeOfInstall(pluginRoot) ?? (env.CODEX_HOME || path21.join(env.HOME || os5.homedir(), ".codex"));
+var codexHomeFor = (pluginRoot, env) => codexHomeOfInstall(pluginRoot) ?? (env.CODEX_HOME || path23.join(env.HOME || os5.homedir(), ".codex"));
 var MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
 var agentMarkerVersion = (text) => MARKER_VERSION.exec(text)?.[1] ?? null;
 var stampCodexAgent = (content, version) => version && content.startsWith(CODEX_AGENT_MARKER) && !agentMarkerVersion(content) ? `${CODEX_AGENT_MARKER} ${version}${content.slice(CODEX_AGENT_MARKER.length)}` : content;
@@ -28422,7 +28662,7 @@ var versionAtLeast = (version, min) => {
 };
 var pluginVersion = (pluginRoot) => {
   try {
-    const version = JSON.parse(readFileSync7(path21.join(pluginRoot, "package.json"), "utf8")).version;
+    const version = JSON.parse(readFileSync7(path23.join(pluginRoot, "package.json"), "utf8")).version;
     return typeof version === "string" && /^\d+\.\d+\.\d+/.test(version) ? version.match(/^\d+\.\d+\.\d+/)[0] : null;
   } catch {
     return null;
@@ -28436,15 +28676,15 @@ var lstatOrNull = (file) => {
   }
 };
 var installCodexAgents = (pluginRoot, codexHome) => {
-  const source = path21.join(pluginRoot, "agents");
+  const source = path23.join(pluginRoot, "agents");
   if (!existsSync9(source))
     return [];
   const version = pluginVersion(pluginRoot);
-  const target = path21.join(codexHome, "agents");
+  const target = path23.join(codexHome, "agents");
   const results = [];
   for (const file of readdirSync5(source).filter((name) => name.endsWith(".toml")).toSorted()) {
-    const content = stampCodexAgent(readFileSync7(path21.join(source, file), "utf8"), version);
-    const dest = path21.join(target, file);
+    const content = stampCodexAgent(readFileSync7(path23.join(source, file), "utf8"), version);
+    const dest = path23.join(target, file);
     const stat = lstatOrNull(dest);
     if (stat?.isSymbolicLink()) {
       results.push({ file: dest, action: "skipped-symlink" });
@@ -28480,7 +28720,7 @@ var installCodexAgents = (pluginRoot, codexHome) => {
       results.push({ file: dest, action: "kept-newer-version" });
       continue;
     }
-    const temp = path21.join(target, `.${file}.${process.pid}.${Date.now()}.tmp`);
+    const temp = path23.join(target, `.${file}.${process.pid}.${Date.now()}.tmp`);
     writeFileSync3(temp, content, { flag: "wx" });
     try {
       renameSync2(temp, dest);
@@ -28502,8 +28742,8 @@ var codexQualification = (host) => host === "codex_cli" ? { surface: host, cli:
 var resolveCodexWorkspaceRoot = (pluginRoot, env) => {
   const explicit = env.WORKFLOW_WORKSPACE_ROOT;
   const inherited = env.PWD;
-  const candidate = explicit ?? (inherited && path22.resolve(inherited) !== path22.resolve(pluginRoot) ? inherited : undefined);
-  if (!candidate || !path22.isAbsolute(candidate) || !existsSync10(candidate))
+  const candidate = explicit ?? (inherited && path24.resolve(inherited) !== path24.resolve(pluginRoot) ? inherited : undefined);
+  if (!candidate || !path24.isAbsolute(candidate) || !existsSync10(candidate))
     return null;
   try {
     if (!statSync3(candidate).isDirectory())
@@ -28542,7 +28782,7 @@ var codexContextProvider = (host = detectCodexSurface(process.env), root) => ({
     };
   }
 });
-var pluginRoot = () => path22.resolve(path22.dirname(fileURLToPath3(import.meta.url)), "..");
+var pluginRoot = () => path24.resolve(path24.dirname(fileURLToPath3(import.meta.url)), "..");
 var syncCodexAgents = (root) => {
   const codexHome = codexHomeOfInstall(root);
   if (!codexHome)