@brainervirus/workit-codex 8.4.1 → 8.5.0

package/dist/{workit-hook-4akmp44q.js → workit-hook-4g395jn3.js}

@@ -24,6 +24,8 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
+import { createHash as createHash10 } from "node:crypto";
+import fs13 from "node:fs";
 import path16 from "node:path";
 
 // packages/workit-core/src/core/methods.ts
@@ -134,8 +136,288 @@ Skills: load the skill, never act from memory of it (slash aliases /wk-<name>).
 - architecture, deepen modules (user-invoked; offer it): workit-architecture
 `.trim();
 
+// packages/workit-core/src/store/paths.ts
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
+var gitRun = (cwd, args) => {
+  const run = spawnSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_OPTIONAL_LOCKS: "0",
+      LC_ALL: "C",
+      LANGUAGE: "C"
+    }
+  });
+  const error = run.error;
+  return {
+    ok: run.status === 0,
+    stdout: run.stdout ?? "",
+    stderr: error ? String(error.message) : run.stderr ?? "",
+    missing: error?.code === "ENOENT"
+  };
+};
+var shortHash = (value) => createHash("sha256").update(value).digest("hex").slice(0, 12);
+var real = (file) => {
+  try {
+    return fs.realpathSync.native(file);
+  } catch {
+    return file;
+  }
+};
+var DISCOVERY_ENV = [
+  "GIT_DIR",
+  "GIT_COMMON_DIR",
+  "GIT_WORK_TREE",
+  "GIT_CEILING_DIRECTORIES",
+  "GIT_DISCOVERY_ACROSS_FILESYSTEM"
+];
+var isGitDir = (dir) => {
+  try {
+    return fs.statSync(path.join(dir, "HEAD")).isFile() && fs.statSync(path.join(dir, "objects")).isDirectory() && fs.statSync(path.join(dir, "refs")).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var reftableRefs = (common) => {
+  try {
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs.readFileSync(path.join(common, "config"), "utf8"));
+  } catch {
+    return false;
+  }
+};
+function fastGit(root) {
+  if (DISCOVERY_ENV.some((name) => process.env[name]))
+    return null;
+  let dir = real(root);
+  let device = null;
+  for (;; ) {
+    let stat;
+    try {
+      stat = fs.statSync(dir);
+    } catch {
+      return null;
+    }
+    if (device !== null && stat.dev !== device)
+      return { kind: "none" };
+    device = stat.dev;
+    const dotGit = path.join(dir, ".git");
+    let entry = null;
+    try {
+      entry = fs.statSync(dotGit);
+    } catch {}
+    let gitDir = null;
+    let top = null;
+    if (entry) {
+      top = dir;
+      if (entry.isDirectory())
+        gitDir = dotGit;
+      else if (entry.isFile()) {
+        let text = "";
+        try {
+          text = fs.readFileSync(dotGit, "utf8");
+        } catch {
+          return null;
+        }
+        const match = /^gitdir: (.+)$/mu.exec(text);
+        if (!match)
+          return null;
+        gitDir = path.resolve(dir, match[1].trim());
+      } else
+        return null;
+      if (!fs.existsSync(path.join(gitDir, "HEAD")))
+        return null;
+    } else if (isGitDir(dir))
+      gitDir = dir;
+    if (gitDir) {
+      let common = gitDir;
+      try {
+        common = path.resolve(gitDir, fs.readFileSync(path.join(gitDir, "commondir"), "utf8").trim());
+      } catch {}
+      if (!fs.existsSync(path.join(common, "objects")))
+        return null;
+      return {
+        kind: "repo",
+        common: real(common),
+        gitDir: real(gitDir),
+        top: top === null ? null : real(top),
+        reftable: reftableRefs(common)
+      };
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir)
+      return { kind: "none" };
+    dir = parent;
+  }
+}
+function resolveStore(root) {
+  root = path.resolve(root);
+  let directory = false;
+  try {
+    directory = fs.statSync(root).isDirectory();
+  } catch {}
+  if (!directory)
+    return { dir: path.join(root, ".workit"), shared: false, top: null };
+  const fast = fastGit(root);
+  if (fast?.kind === "none")
+    return { dir: path.join(root, ".workit"), shared: false, top: null };
+  if (fast?.kind === "repo")
+    return {
+      dir: path.join(fast.common, "workit"),
+      shared: true,
+      top: fast.top,
+      git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
+    };
+  const run = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  const common = run.stdout.trim();
+  if (run.ok && common) {
+    const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
+    return {
+      dir: path.join(real(path.resolve(root, common)), "workit"),
+      shared: true,
+      top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
+    };
+  }
+  if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
+    return { dir: path.join(root, ".workit"), shared: false, top: null };
+  return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
+`)[0] || "no output"}); fix the repository (git status should work here)`);
+}
+var rebasingBranch = (gitDir) => {
+  for (const state of ["rebase-merge", "rebase-apply"]) {
+    try {
+      const ref = fs.readFileSync(path.join(gitDir, state, "head-name"), "utf8").trim();
+      const match = /^refs\/heads\/(.+)$/u.exec(ref);
+      if (match)
+        return match[1];
+    } catch {}
+  }
+  return null;
+};
+function resolveTaskKey(root, location) {
+  if (!location.shared)
+    return { key: `dir-${shortHash(root)}`, kind: "dir", branch: null };
+  const branchKey = (name) => ({ key: name, kind: "branch", branch: name });
+  if (location.git && !location.git.reftable) {
+    let head = "";
+    try {
+      head = fs.readFileSync(path.join(location.git.gitDir, "HEAD"), "utf8").trim();
+    } catch {}
+    const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
+    if (ref && ref[1] !== ".invalid")
+      return branchKey(ref[1]);
+    if (/^[0-9a-f]{40,64}$/u.test(head)) {
+      const rebasing = rebasingBranch(location.git.gitDir);
+      if (rebasing)
+        return branchKey(rebasing);
+      return {
+        key: `detached-${shortHash(location.git.top ?? location.git.gitDir)}`,
+        kind: "detached",
+        branch: null
+      };
+    }
+  }
+  const branch = gitRun(root, ["symbolic-ref", "-q", "--short", "HEAD"]);
+  const name = branch.ok ? branch.stdout.trim() : "";
+  if (name && name !== ".invalid")
+    return branchKey(name);
+  const gitDir = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-dir"]);
+  if (gitDir.ok && gitDir.stdout.trim()) {
+    const rebasing = rebasingBranch(gitDir.stdout.trim());
+    if (rebasing)
+      return branchKey(rebasing);
+  }
+  const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
+  const worktree = top.ok && top.stdout.trim() ? top.stdout.trim() : root;
+  return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
+}
+function checkoutRootOf(root, location) {
+  const resolved = path.resolve(root);
+  let canonical = resolved;
+  try {
+    canonical = fs.realpathSync(resolved);
+  } catch {
+    return resolved;
+  }
+  const found = location ?? resolveStore(canonical);
+  if (found instanceof Error || !found.shared || !found.top)
+    return canonical;
+  if (real(canonical) === found.top)
+    return canonical;
+  try {
+    return fs.realpathSync(found.top);
+  } catch {
+    return canonical;
+  }
+}
+function branchRenames(location) {
+  if (!location.shared)
+    return [];
+  const files = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries)
+      if (entry.isDirectory())
+        walk(path.join(dir, entry.name));
+      else
+        files.push(path.join(dir, entry.name));
+  };
+  walk(path.join(path.dirname(location.dir), "logs", "refs", "heads"));
+  if (location.git)
+    files.push(path.join(location.git.gitDir, "logs", "HEAD"));
+  const seen = new Set;
+  const renames = [];
+  for (const file of files) {
+    let text = "";
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of text.matchAll(/ (\d+) [+-]\d{4}\tBranch: renamed refs\/heads\/(\S+) to refs\/heads\/(\S+)/gu)) {
+      const rename = { from: match[2], to: match[3], at: Number(match[1]) };
+      const id = `${rename.at}\x00${rename.from}\x00${rename.to}`;
+      if (seen.has(id))
+        continue;
+      seen.add(id);
+      renames.push(rename);
+    }
+  }
+  return renames.toSorted((left, right) => left.at - right.at);
+}
+function followRenames(key, boundAt, renames) {
+  let current = key;
+  let since = Math.floor(Date.parse(boundAt) / 1000);
+  for (const rename of renames)
+    if (rename.from === current && rename.at >= since) {
+      current = rename.to;
+      since = rename.at;
+    }
+  return current;
+}
+var checkoutSlug = (root) => {
+  let canonical = real(root);
+  if (process.platform === "win32")
+    canonical = canonical.toLowerCase();
+  const base = path.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  return `${base}-${shortHash(canonical)}`;
+};
+
 // packages/workit-core/src/core/task-contract.ts
-import { createHash, randomUUID } from "node:crypto";
+import { createHash as createHash2, randomUUID } from "node:crypto";
 
 // node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
@@ -8456,7 +8738,7 @@ function canonicalJson(value) {
 function sha256(value) {
   if (typeof value === "string" && invalidUnicode(value))
     throw new TypeError("invalid Unicode");
-  return createHash("sha256").update(typeof value === "string" ? value : canonicalJson(value), "utf8").digest("hex");
+  return createHash2("sha256").update(typeof value === "string" ? value : canonicalJson(value), "utf8").digest("hex");
 }
 function newId() {
   return randomUUID().toLowerCase();
@@ -8511,9 +8793,9 @@ import { spawnSync as spawnSync10 } from "node:child_process";
 import path14 from "node:path";
 
 // packages/workit-core/src/check-config.ts
-import { spawnSync } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import fs2 from "node:fs";
+import path2 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
 var CHECKS_FILE = "workit.checks.json";
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -8555,7 +8837,7 @@ function splitCommand(command) {
   return argv.length ? argv : new Error("empty command");
 }
 var git = (cwd, args) => {
-  const run = spawnSync("git", args, {
+  const run = spawnSync2("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 20000,
@@ -8566,10 +8848,10 @@ var git = (cwd, args) => {
   return value || null;
 };
 function checkRoot(cwd) {
-  return path.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+  return path2.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
 }
 var packageManager = (root) => {
-  const has = (file) => fs.existsSync(path.join(root, file));
+  const has = (file) => fs2.existsSync(path2.join(root, file));
   if (has("bun.lock") || has("bun.lockb"))
     return "bun";
   if (has("pnpm-lock.yaml"))
@@ -8589,7 +8871,7 @@ var CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
 function detectedChecks(root) {
   const read = (file) => {
     try {
-      return fs.readFileSync(path.join(root, file), "utf8");
+      return fs2.readFileSync(path2.join(root, file), "utf8");
     } catch {
       return null;
     }
@@ -8628,7 +8910,7 @@ function detectedChecks(root) {
 var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
-  const file = path.join(root, CHECKS_FILE);
+  const file = path2.join(root, CHECKS_FILE);
   const none = (error = null) => ({
     source: error ? CHECKS_FILE : "none",
     root,
@@ -8638,7 +8920,7 @@ function loadCheckConfig(cwd) {
   });
   let text = null;
   try {
-    text = fs.readFileSync(file, "utf8");
+    text = fs2.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
       return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
@@ -8701,10 +8983,10 @@ function workitAvailable(env = process.env) {
     return workitOnPath;
   const windows = process.platform === "win32";
   const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  const dirs = (env.PATH ?? env.Path ?? "").split(path.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path2.delimiter).filter(Boolean);
   workitOnPath = dirs.some((dir) => exts.some((ext) => {
     try {
-      return fs.statSync(path.join(dir, `workit${ext}`)).isFile();
+      return fs2.statSync(path2.join(dir, `workit${ext}`)).isFile();
     } catch {
       return false;
     }
@@ -8716,15 +8998,15 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 }
 
 // packages/workit-core/src/git/rev.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
-import fs2 from "node:fs";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
+import fs3 from "node:fs";
 import os from "node:os";
-import path2 from "node:path";
+import path3 from "node:path";
 var MAX_BUFFER = 256 * 1024 * 1024;
 var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
 var git2 = (cwd, args, options = {}) => {
-  const result = spawnSync2("git", args, {
+  const result = spawnSync3("git", args, {
     cwd,
     encoding: "utf8",
     env: options.env ?? process.env,
@@ -8755,10 +9037,10 @@ function headSha(cwd) {
 var emptyTree = (cwd) => line(git2(cwd, ["mktree"], { input: "" }));
 var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
 var seedIndex = (from, to) => {
-  fs2.copyFileSync(from, to);
-  const { atimeNs, mtimeNs } = fs2.statSync(from, { bigint: true });
+  fs3.copyFileSync(from, to);
+  const { atimeNs, mtimeNs } = fs3.statSync(from, { bigint: true });
   const seconds = (ns) => (Number(ns / 1000n) - 1) / 1e6;
-  fs2.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
+  fs3.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
 };
 function worktreeTree(cwd, options = {}) {
   const top = line(git2(cwd, ["rev-parse", "--show-toplevel"]));
@@ -8767,10 +9049,10 @@ function worktreeTree(cwd, options = {}) {
     return null;
   const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
   const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
-  const scratch = fs2.mkdtempSync(path2.join(os.tmpdir(), "workit-tree-"));
+  const scratch = fs3.mkdtempSync(path3.join(os.tmpdir(), "workit-tree-"));
   try {
-    const tempIndex = path2.join(scratch, "index");
-    if (fs2.existsSync(indexPath))
+    const tempIndex = path3.join(scratch, "index");
+    if (fs3.existsSync(indexPath))
       seedIndex(indexPath, tempIndex);
     const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
     const untracked = git2(top, ["ls-files", "--others", "--exclude-standard", "-z"], {
@@ -8782,7 +9064,7 @@ function worktreeTree(cwd, options = {}) {
     const skipped = [];
     for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
       try {
-        const stat = fs2.statSync(path2.join(top, file));
+        const stat = fs3.statSync(path3.join(top, file));
         if (stat.isFile() && stat.size > cap)
           skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
       } catch {}
@@ -8799,10 +9081,10 @@ function worktreeTree(cwd, options = {}) {
     if (!tree)
       return null;
     const base = line(git2(top, ["rev-parse", "--verify", "-q", "HEAD^{tree}"])) ?? emptyTree(top);
-    const key = skipped.length ? `sha256:${createHash2("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
+    const key = skipped.length ? `sha256:${createHash3("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
     return { tree, key, dirty: tree !== base || skipped.length > 0, skipped };
   } finally {
-    fs2.rmSync(scratch, { recursive: true, force: true });
+    fs3.rmSync(scratch, { recursive: true, force: true });
   }
 }
 function worktreeSignal(cwd, options = {}) {
@@ -8822,16 +9104,16 @@ function worktreeSignal(cwd, options = {}) {
   });
   if (!status.ok)
     return null;
-  const hash = createHash2("sha256");
+  const hash = createHash3("sha256");
   hash.update(`${headSha(top) ?? "unborn"}\x00`);
   for (const entry of status.stdout.split("\x00")) {
     if (entry.length < 4)
       continue;
     const file = entry.slice(3);
-    const absolute = path2.join(top, file);
+    const absolute = path3.join(top, file);
     let stat = "-";
     try {
-      const info = fs2.lstatSync(absolute, { bigint: true });
+      const info = fs3.lstatSync(absolute, { bigint: true });
       stat = `${info.mode.toString(8)}:${info.size}:${info.mtimeNs}`;
       if (info.isDirectory())
         stat += `:${headSha(absolute) ?? "-"}`;
@@ -8950,10 +9232,10 @@ function sameFileIdentity(left, right, platform = process.platform) {
 // node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
 import { randomBytes } from "node:crypto";
 import fsSync from "node:fs";
-import path3 from "node:path";
+import path4 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/bounded-read.js
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 
 // node_modules/@openclaw/fs-safe/dist/byte-budget.js
 function normalizeMaxBytes(value, options = {}) {
@@ -8990,7 +9272,7 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
   let total = 0;
   while (true) {
     const length = nextReadLength(total, maxBytes, scratch.length);
-    const bytesRead = fs3.readSync(fd, scratch, 0, length, null);
+    const bytesRead = fs4.readSync(fd, scratch, 0, length, null);
     if (bytesRead === 0) {
       return Buffer.concat(chunks, total);
     }
@@ -8999,9 +9281,9 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
 }
 
 // node_modules/@openclaw/fs-safe/dist/read-open-flags.js
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 function resolveReadOpenFlags(options) {
-  const constants = options?.constants ?? fs4.constants;
+  const constants = options?.constants ?? fs5.constants;
   const noFollow = process.platform !== "win32" && options?.followSymlinks !== true && typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
   const nonBlocking = process.platform !== "win32" && typeof constants.O_NONBLOCK === "number" ? constants.O_NONBLOCK : 0;
   return constants.O_RDONLY | noFollow | nonBlocking;
@@ -9040,13 +9322,13 @@ ${ownershipToken}
   return { raw, ownershipToken };
 }
 function relativeSidecarLockPath(lockRoot, lockPath) {
-  const resolved = path3.resolve(lockPath);
-  const lexicalRelative = path3.relative(lockRoot.rootDir, resolved);
-  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path3.sep}`) && !path3.isAbsolute(lexicalRelative) ? lexicalRelative : path3.relative(lockRoot.rootReal, resolved);
-  if (!relative || relative === ".." || relative.startsWith(`..${path3.sep}`) || path3.isAbsolute(relative)) {
+  const resolved = path4.resolve(lockPath);
+  const lexicalRelative = path4.relative(lockRoot.rootDir, resolved);
+  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path4.sep}`) && !path4.isAbsolute(lexicalRelative) ? lexicalRelative : path4.relative(lockRoot.rootReal, resolved);
+  if (!relative || relative === ".." || relative.startsWith(`..${path4.sep}`) || path4.isAbsolute(relative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock path is outside lockRoot");
   }
-  return relative.split(path3.sep).join(path3.posix.sep);
+  return relative.split(path4.sep).join(path4.posix.sep);
 }
 function parseSidecarLockPayload(raw, parser) {
   if (parser) {
@@ -9192,8 +9474,8 @@ function getFsSafeLockConfig() {
 }
 
 // node_modules/@openclaw/fs-safe/dist/file-lock-sync.js
-import fs5 from "node:fs";
-import path4 from "node:path";
+import fs6 from "node:fs";
+import path5 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/timing.js
 function sleepSync(ms) {
@@ -9223,7 +9505,7 @@ function releaseAllSyncHeldLocks() {
     }
     try {
       if (held.fd !== undefined)
-        fs5.closeSync(held.fd);
+        fs6.closeSync(held.fd);
     } catch {}
     try {
       removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
@@ -9258,7 +9540,7 @@ function releaseSyncHeldLock(held) {
   if (held.fd !== undefined) {
     const fd = held.fd;
     held.fd = undefined;
-    fs5.closeSync(fd);
+    fs6.closeSync(fd);
   }
   removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
   heldLocks.delete(held.normalizedTargetPath);
@@ -9281,29 +9563,29 @@ function createSyncHeldLockHandle(held) {
   };
 }
 function canonicalLockParentSync(parent) {
-  return process.platform === "win32" ? fs5.realpathSync.native(parent) : fs5.realpathSync(parent);
+  return process.platform === "win32" ? fs6.realpathSync.native(parent) : fs6.realpathSync(parent);
 }
 function normalizeTargetPath(targetPath) {
-  const resolved = path4.resolve(targetPath);
-  fs5.mkdirSync(path4.dirname(resolved), { recursive: true });
+  const resolved = path5.resolve(targetPath);
+  fs6.mkdirSync(path5.dirname(resolved), { recursive: true });
   try {
-    return path4.join(canonicalLockParentSync(path4.dirname(resolved)), path4.basename(resolved));
+    return path5.join(canonicalLockParentSync(path5.dirname(resolved)), path5.basename(resolved));
   } catch {
     return resolved;
   }
 }
 function boundedLockPath(lockPath, lockRoot) {
-  const resolved = path4.resolve(lockPath);
+  const resolved = path5.resolve(lockPath);
   if (!lockRoot)
     return resolved;
   relativeSidecarLockPath(lockRoot, resolved);
-  const parent = path4.dirname(resolved);
+  const parent = path5.dirname(resolved);
   const parentReal = canonicalLockParentSync(parent);
-  const parentRelative = path4.relative(lockRoot.rootReal, parentReal);
-  if (parentRelative === ".." || parentRelative.startsWith(`..${path4.sep}`) || path4.isAbsolute(parentRelative)) {
+  const parentRelative = path5.relative(lockRoot.rootReal, parentReal);
+  if (parentRelative === ".." || parentRelative.startsWith(`..${path5.sep}`) || path5.isAbsolute(parentRelative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock parent is outside lockRoot");
   }
-  return path4.join(parentReal, path4.basename(resolved));
+  return path5.join(parentReal, path5.basename(resolved));
 }
 function defaultShouldReclaim(snapshot, staleMs, nowMs) {
   const createdAtMs = sidecarLockPayloadCreatedAtMs(snapshot.payload);
@@ -9313,7 +9595,7 @@ function defaultShouldReclaim(snapshot, staleMs, nowMs) {
 }
 function reclaimGuardExists(reclaimGuardPath) {
   try {
-    fs5.lstatSync(reclaimGuardPath);
+    fs6.lstatSync(reclaimGuardPath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT")
@@ -9377,19 +9659,19 @@ function acquireFileLockSync(targetPath, options) {
     const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
     let lockFileCreateDenied = false;
     try {
-      const noFollow = process.platform !== "win32" && typeof fs5.constants.O_NOFOLLOW === "number" ? fs5.constants.O_NOFOLLOW : 0;
+      const noFollow = process.platform !== "win32" && typeof fs6.constants.O_NOFOLLOW === "number" ? fs6.constants.O_NOFOLLOW : 0;
       try {
-        fd = fs5.openSync(lockPath, fs5.constants.O_WRONLY | fs5.constants.O_CREAT | fs5.constants.O_EXCL | noFollow, 384);
+        fd = fs6.openSync(lockPath, fs6.constants.O_WRONLY | fs6.constants.O_CREAT | fs6.constants.O_EXCL | noFollow, 384);
       } catch (error) {
         lockFileCreateDenied = isTransientLockFileDenial(error, lockPath);
         throw error;
       }
-      fs5.writeFileSync(fd, raw, "utf8");
-      fs5.fsyncSync(fd);
+      fs6.writeFileSync(fd, raw, "utf8");
+      fs6.fsyncSync(fd);
       const snapshot = {
         raw,
         payload,
-        stat: fs5.fstatSync(fd),
+        stat: fs6.fstatSync(fd),
         ownershipToken
       };
       const createdHeld = {
@@ -9424,8 +9706,8 @@ function acquireFileLockSync(targetPath, options) {
       return returnedHandle;
     } catch (error) {
       if (fd !== undefined) {
-        const failed = { payload: null, stat: fs5.fstatSync(fd) };
-        fs5.closeSync(fd);
+        const failed = { payload: null, stat: fs6.fstatSync(fd) };
+        fs6.closeSync(fd);
         fd = undefined;
         removeSidecarLockIfUnchangedSync(lockPath, failed);
       }
@@ -9444,393 +9726,111 @@ function acquireFileLockSync(targetPath, options) {
           rejectNonFile: true,
           onOpenFailure: (error) => {
             lockFileOpenDenied = isTransientLockFileDenial(error, lockPath);
-          }
-        });
-      } catch (readError) {
-        if (lockFileOpenDenied && retryLockFileDenial(readError))
-          continue;
-        throw readError;
-      }
-      const snapshot = parseSidecarLockSnapshot(rawSnapshot, options.parsePayload);
-      if (!snapshot) {
-        waitForRetry();
-        continue;
-      }
-      const nowMs = Date.now();
-      const reclaim = options.shouldReclaim ? options.shouldReclaim({
-        lockPath,
-        normalizedTargetPath,
-        payload: snapshot.payload,
-        staleMs,
-        nowMs,
-        heldByThisProcess: false
-      }) : defaultShouldReclaim(snapshot, staleMs, nowMs);
-      if (reclaim) {
-        if (staleRecovery === "remove-if-unchanged" && snapshot.raw !== undefined && options.shouldRemoveStaleLock?.({
-          lockPath,
-          normalizedTargetPath,
-          raw: snapshot.raw,
-          payload: snapshot.payload
-        })) {
-          let ownsReclaimGuard = false;
-          try {
-            fs5.mkdirSync(reclaimGuardPath);
-            ownsReclaimGuard = true;
-            if (removeSidecarLockIfUnchangedSync(lockPath, snapshot))
-              continue;
-          } catch (reclaimError) {
-            if (reclaimError.code !== "EEXIST") {
-              throw reclaimError;
-            }
-            waitForRetry();
-            continue;
-          } finally {
-            if (ownsReclaimGuard) {
-              try {
-                fs5.rmdirSync(reclaimGuardPath);
-              } catch {}
-            }
-          }
-        }
-        throw Object.assign(new Error(`file lock stale for ${normalizedTargetPath}`), {
-          code: "file_lock_stale",
-          lockPath,
-          normalizedTargetPath
-        });
-      }
-      waitForRetry();
-    }
-  }
-}
-// packages/workit-core/src/host-session.ts
-var HOST_SESSION_VARS = [
-  ["OPENCODE_SESSION_ID", () => "opencode"],
-  ["PI_SESSION_ID", () => "pi"],
-  [
-    "CODEX_THREAD_ID",
-    (env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
-  ]
-];
-var family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null;
-function hostSessionFromEnv(env) {
-  const value = (key) => env[key]?.trim() || null;
-  let inner = null;
-  for (const [key, host] of HOST_SESSION_VARS) {
-    const session = value(key);
-    if (session) {
-      inner = { host: host(env), session };
-      break;
-    }
-  }
-  const declared = value("WORKIT_HOST");
-  if (env.WORKIT_SESSION_ID !== undefined) {
-    const inherited = inner !== null && declared !== null && family(declared) !== family(inner.host);
-    if (!inherited)
-      return { host: declared, session: value("WORKIT_SESSION_ID") };
-  }
-  return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
-}
-
-// packages/workit-core/src/core/package-root.ts
-import { existsSync } from "node:fs";
-import path5 from "node:path";
-import { fileURLToPath } from "node:url";
-var packageRoot = () => {
-  let dir = path5.dirname(fileURLToPath(import.meta.url));
-  while (true) {
-    const parent = path5.dirname(dir);
-    if (existsSync(path5.join(dir, "package.json")) || parent === dir)
-      return dir;
-    dir = parent;
-  }
-};
-
-// packages/workit-core/src/core/store-lock.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import fs7 from "node:fs";
-import { hostname } from "node:os";
-
-// packages/workit-core/src/store/paths.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { createHash as createHash3 } from "node:crypto";
-import fs6 from "node:fs";
-import path6 from "node:path";
-var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
-var gitRun = (cwd, args) => {
-  const run = spawnSync3("git", args, {
-    cwd,
-    encoding: "utf8",
-    timeout: 20000,
-    killSignal: "SIGKILL",
-    windowsHide: true,
-    env: {
-      ...process.env,
-      GIT_TERMINAL_PROMPT: "0",
-      GIT_OPTIONAL_LOCKS: "0",
-      LC_ALL: "C",
-      LANGUAGE: "C"
-    }
-  });
-  const error = run.error;
-  return {
-    ok: run.status === 0,
-    stdout: run.stdout ?? "",
-    stderr: error ? String(error.message) : run.stderr ?? "",
-    missing: error?.code === "ENOENT"
-  };
-};
-var shortHash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 12);
-var real = (file) => {
-  try {
-    return fs6.realpathSync.native(file);
-  } catch {
-    return file;
-  }
-};
-var DISCOVERY_ENV = [
-  "GIT_DIR",
-  "GIT_COMMON_DIR",
-  "GIT_WORK_TREE",
-  "GIT_CEILING_DIRECTORIES",
-  "GIT_DISCOVERY_ACROSS_FILESYSTEM"
-];
-var isGitDir = (dir) => {
-  try {
-    return fs6.statSync(path6.join(dir, "HEAD")).isFile() && fs6.statSync(path6.join(dir, "objects")).isDirectory() && fs6.statSync(path6.join(dir, "refs")).isDirectory();
-  } catch {
-    return false;
-  }
-};
-var reftableRefs = (common) => {
-  try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs6.readFileSync(path6.join(common, "config"), "utf8"));
-  } catch {
-    return false;
-  }
-};
-function fastGit(root) {
-  if (DISCOVERY_ENV.some((name) => process.env[name]))
-    return null;
-  let dir = real(root);
-  let device = null;
-  for (;; ) {
-    let stat;
-    try {
-      stat = fs6.statSync(dir);
-    } catch {
-      return null;
-    }
-    if (device !== null && stat.dev !== device)
-      return { kind: "none" };
-    device = stat.dev;
-    const dotGit = path6.join(dir, ".git");
-    let entry = null;
-    try {
-      entry = fs6.statSync(dotGit);
-    } catch {}
-    let gitDir = null;
-    let top = null;
-    if (entry) {
-      top = dir;
-      if (entry.isDirectory())
-        gitDir = dotGit;
-      else if (entry.isFile()) {
-        let text = "";
-        try {
-          text = fs6.readFileSync(dotGit, "utf8");
-        } catch {
-          return null;
-        }
-        const match = /^gitdir: (.+)$/mu.exec(text);
-        if (!match)
-          return null;
-        gitDir = path6.resolve(dir, match[1].trim());
-      } else
-        return null;
-      if (!fs6.existsSync(path6.join(gitDir, "HEAD")))
-        return null;
-    } else if (isGitDir(dir))
-      gitDir = dir;
-    if (gitDir) {
-      let common = gitDir;
-      try {
-        common = path6.resolve(gitDir, fs6.readFileSync(path6.join(gitDir, "commondir"), "utf8").trim());
-      } catch {}
-      if (!fs6.existsSync(path6.join(common, "objects")))
-        return null;
-      return {
-        kind: "repo",
-        common: real(common),
-        gitDir: real(gitDir),
-        top: top === null ? null : real(top),
-        reftable: reftableRefs(common)
-      };
-    }
-    const parent = path6.dirname(dir);
-    if (parent === dir)
-      return { kind: "none" };
-    dir = parent;
-  }
-}
-function resolveStore(root) {
-  root = path6.resolve(root);
-  let directory = false;
-  try {
-    directory = fs6.statSync(root).isDirectory();
-  } catch {}
-  if (!directory)
-    return { dir: path6.join(root, ".workit"), shared: false, top: null };
-  const fast = fastGit(root);
-  if (fast?.kind === "none")
-    return { dir: path6.join(root, ".workit"), shared: false, top: null };
-  if (fast?.kind === "repo")
-    return {
-      dir: path6.join(fast.common, "workit"),
-      shared: true,
-      top: fast.top,
-      git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
-    };
-  const run = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
-  const common = run.stdout.trim();
-  if (run.ok && common) {
-    const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
-    return {
-      dir: path6.join(real(path6.resolve(root, common)), "workit"),
-      shared: true,
-      top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
-    };
-  }
-  if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path6.join(root, ".workit"), shared: false, top: null };
-  return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
-`)[0] || "no output"}); fix the repository (git status should work here)`);
-}
-var rebasingBranch = (gitDir) => {
-  for (const state of ["rebase-merge", "rebase-apply"]) {
-    try {
-      const ref = fs6.readFileSync(path6.join(gitDir, state, "head-name"), "utf8").trim();
-      const match = /^refs\/heads\/(.+)$/u.exec(ref);
-      if (match)
-        return match[1];
-    } catch {}
-  }
-  return null;
-};
-function resolveTaskKey(root, location) {
-  if (!location.shared)
-    return { key: `dir-${shortHash(root)}`, kind: "dir", branch: null };
-  const branchKey = (name) => ({ key: name, kind: "branch", branch: name });
-  if (location.git && !location.git.reftable) {
-    let head = "";
-    try {
-      head = fs6.readFileSync(path6.join(location.git.gitDir, "HEAD"), "utf8").trim();
-    } catch {}
-    const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
-    if (ref && ref[1] !== ".invalid")
-      return branchKey(ref[1]);
-    if (/^[0-9a-f]{40,64}$/u.test(head)) {
-      const rebasing = rebasingBranch(location.git.gitDir);
-      if (rebasing)
-        return branchKey(rebasing);
-      return {
-        key: `detached-${shortHash(location.git.top ?? location.git.gitDir)}`,
-        kind: "detached",
-        branch: null
-      };
-    }
-  }
-  const branch = gitRun(root, ["symbolic-ref", "-q", "--short", "HEAD"]);
-  const name = branch.ok ? branch.stdout.trim() : "";
-  if (name && name !== ".invalid")
-    return branchKey(name);
-  const gitDir = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-dir"]);
-  if (gitDir.ok && gitDir.stdout.trim()) {
-    const rebasing = rebasingBranch(gitDir.stdout.trim());
-    if (rebasing)
-      return branchKey(rebasing);
-  }
-  const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
-  const worktree = top.ok && top.stdout.trim() ? top.stdout.trim() : root;
-  return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
-}
-function checkoutRootOf(root, location) {
-  const resolved = path6.resolve(root);
-  let canonical = resolved;
-  try {
-    canonical = fs6.realpathSync(resolved);
-  } catch {
-    return resolved;
-  }
-  const found = location ?? resolveStore(canonical);
-  if (found instanceof Error || !found.shared || !found.top)
-    return canonical;
-  if (real(canonical) === found.top)
-    return canonical;
-  try {
-    return fs6.realpathSync(found.top);
-  } catch {
-    return canonical;
-  }
-}
-function branchRenames(location) {
-  if (!location.shared)
-    return [];
-  const files = [];
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = fs6.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries)
-      if (entry.isDirectory())
-        walk(path6.join(dir, entry.name));
-      else
-        files.push(path6.join(dir, entry.name));
-  };
-  walk(path6.join(path6.dirname(location.dir), "logs", "refs", "heads"));
-  if (location.git)
-    files.push(path6.join(location.git.gitDir, "logs", "HEAD"));
-  const seen = new Set;
-  const renames = [];
-  for (const file of files) {
-    let text = "";
-    try {
-      text = fs6.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    for (const match of text.matchAll(/ (\d+) [+-]\d{4}\tBranch: renamed refs\/heads\/(\S+) to refs\/heads\/(\S+)/gu)) {
-      const rename = { from: match[2], to: match[3], at: Number(match[1]) };
-      const id = `${rename.at}\x00${rename.from}\x00${rename.to}`;
-      if (seen.has(id))
+          }
+        });
+      } catch (readError) {
+        if (lockFileOpenDenied && retryLockFileDenial(readError))
+          continue;
+        throw readError;
+      }
+      const snapshot = parseSidecarLockSnapshot(rawSnapshot, options.parsePayload);
+      if (!snapshot) {
+        waitForRetry();
         continue;
-      seen.add(id);
-      renames.push(rename);
+      }
+      const nowMs = Date.now();
+      const reclaim = options.shouldReclaim ? options.shouldReclaim({
+        lockPath,
+        normalizedTargetPath,
+        payload: snapshot.payload,
+        staleMs,
+        nowMs,
+        heldByThisProcess: false
+      }) : defaultShouldReclaim(snapshot, staleMs, nowMs);
+      if (reclaim) {
+        if (staleRecovery === "remove-if-unchanged" && snapshot.raw !== undefined && options.shouldRemoveStaleLock?.({
+          lockPath,
+          normalizedTargetPath,
+          raw: snapshot.raw,
+          payload: snapshot.payload
+        })) {
+          let ownsReclaimGuard = false;
+          try {
+            fs6.mkdirSync(reclaimGuardPath);
+            ownsReclaimGuard = true;
+            if (removeSidecarLockIfUnchangedSync(lockPath, snapshot))
+              continue;
+          } catch (reclaimError) {
+            if (reclaimError.code !== "EEXIST") {
+              throw reclaimError;
+            }
+            waitForRetry();
+            continue;
+          } finally {
+            if (ownsReclaimGuard) {
+              try {
+                fs6.rmdirSync(reclaimGuardPath);
+              } catch {}
+            }
+          }
+        }
+        throw Object.assign(new Error(`file lock stale for ${normalizedTargetPath}`), {
+          code: "file_lock_stale",
+          lockPath,
+          normalizedTargetPath
+        });
+      }
+      waitForRetry();
     }
   }
-  return renames.toSorted((left, right) => left.at - right.at);
 }
-function followRenames(key, boundAt, renames) {
-  let current = key;
-  let since = Math.floor(Date.parse(boundAt) / 1000);
-  for (const rename of renames)
-    if (rename.from === current && rename.at >= since) {
-      current = rename.to;
-      since = rename.at;
+// packages/workit-core/src/host-session.ts
+var HOST_SESSION_VARS = [
+  ["OPENCODE_SESSION_ID", () => "opencode"],
+  ["PI_SESSION_ID", () => "pi"],
+  [
+    "CODEX_THREAD_ID",
+    (env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
+  ]
+];
+var family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null;
+function hostSessionFromEnv(env) {
+  const value = (key) => env[key]?.trim() || null;
+  let inner = null;
+  for (const [key, host] of HOST_SESSION_VARS) {
+    const session = value(key);
+    if (session) {
+      inner = { host: host(env), session };
+      break;
     }
-  return current;
+  }
+  const declared = value("WORKIT_HOST");
+  if (env.WORKIT_SESSION_ID !== undefined) {
+    const inherited = inner !== null && declared !== null && family(declared) !== family(inner.host);
+    if (!inherited)
+      return { host: declared, session: value("WORKIT_SESSION_ID") };
+  }
+  return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
 }
-var checkoutSlug = (root) => {
-  let canonical = real(root);
-  if (process.platform === "win32")
-    canonical = canonical.toLowerCase();
-  const base = path6.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
-  return `${base}-${shortHash(canonical)}`;
+
+// packages/workit-core/src/core/package-root.ts
+import { existsSync } from "node:fs";
+import path6 from "node:path";
+import { fileURLToPath } from "node:url";
+var packageRoot = () => {
+  let dir = path6.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const parent = path6.dirname(dir);
+    if (existsSync(path6.join(dir, "package.json")) || parent === dir)
+      return dir;
+    dir = parent;
+  }
 };
 
 // packages/workit-core/src/core/store-lock.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+import fs7 from "node:fs";
+import { hostname } from "node:os";
 var metadataLockSchema = object({
   pid: number2().int().nonnegative().safe(),
   processStart: string2().nullable(),
@@ -17422,8 +17422,77 @@ var turnContextText = (input, descriptor) => {
     return null;
   }
 };
+var TURN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+var digestOf = (text) => createHash10("sha256").update(text).digest("hex");
+var turnMarker = (input) => {
+  if (!input.session.id)
+    return null;
+  try {
+    const location = resolveStore(input.cwd);
+    if (location instanceof Error)
+      return null;
+    const session = [input.host, input.session.id, input.session.agentId ?? ""].join("\x00");
+    return path16.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
+  } catch {
+    return null;
+  }
+};
+var writeTurnDigest = (file, digest) => {
+  try {
+    fs13.mkdirSync(path16.dirname(file), { recursive: true });
+    fs13.writeFileSync(file, `${JSON.stringify({ digest })}
+`);
+  } catch {}
+};
+var clearTurnDigest = (file) => {
+  try {
+    fs13.rmSync(file, { force: true });
+  } catch {}
+};
+var pruneTurnDigests = (dir, now) => {
+  try {
+    for (const name of fs13.readdirSync(dir)) {
+      if (!name.startsWith("turn-"))
+        continue;
+      const file = path16.join(dir, name);
+      try {
+        if (now - fs13.statSync(file).mtimeMs > TURN_TTL_MS)
+          fs13.rmSync(file, { force: true });
+      } catch {}
+    }
+  } catch {}
+};
+var changedTurnContext = (input, text) => {
+  const file = turnMarker(input);
+  if (!text) {
+    if (file)
+      clearTurnDigest(file);
+    return null;
+  }
+  if (!file)
+    return text;
+  const digest = digestOf(text);
+  try {
+    const previous = JSON.parse(fs13.readFileSync(file, "utf8"));
+    if (previous.digest === digest)
+      return null;
+  } catch {}
+  writeTurnDigest(file, digest);
+  return text;
+};
+var seedTurnContext = (input, descriptor) => {
+  const file = turnMarker(input);
+  if (!file)
+    return;
+  pruneTurnDigests(path16.dirname(file), Date.now());
+  const text = turnContextText(input, descriptor);
+  if (text)
+    writeTurnDigest(file, digestOf(text));
+  else
+    clearTurnDigest(file);
+};
 // packages/workit-core/src/core/branch.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 var withReleaseTracks = (workspaceRoot, policy) => {
   const read = workspaceReleaseTracks(workspaceRoot);
   if (read.error)
@@ -17491,7 +17560,7 @@ var branchPolicySnapshotFor = (workspaceRoot) => {
   const source = resolved.provenance.branchPolicy;
   const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
   const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
-  const fingerprint = createHash10("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
+  const fingerprint = createHash11("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
   return {
     branchPolicy,
     namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
@@ -17826,7 +17895,7 @@ function writeGate(cwd, paths) {
     const gate = gateFor(cwd);
     if (!gate || gate.blockers.length === 0)
       return NONE2;
-    if (paths && paths.every((file) => exempt(cwd, gate.root, file, gate.plans)))
+    if (paths?.length && paths.every((file) => exempt(cwd, gate.root, file, gate.plans)))
       return NONE2;
     const reasons = gate.blockers.map((item) => `${item.ruleId}: ${item.reason}`).join("; ");
     return {
@@ -17840,8 +17909,8 @@ function writeGate(cwd, paths) {
 }
 // packages/workit-core/src/hooks/raw-git.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
-import { createHash as createHash11 } from "node:crypto";
-import fs13 from "node:fs";
+import { createHash as createHash12 } from "node:crypto";
+import fs14 from "node:fs";
 import os4 from "node:os";
 import path18 from "node:path";
 var NONE3 = { kind: "none" };
@@ -18087,7 +18156,7 @@ var repoAt = (dir) => {
   return { location, dir, branch: resolveTaskKey(dir, location).branch };
 };
 var isWorkitWorkspace = (repo) => {
-  if (fs13.existsSync(repo.location.dir))
+  if (fs14.existsSync(repo.location.dir))
     return true;
   try {
     return resolveRuntimeWorkspaceVcs(repo.location.top ?? repo.dir) !== null;
@@ -18118,7 +18187,7 @@ var headSha2 = (repo) => {
   if (!git || git.reftable)
     return null;
   try {
-    const head = fs13.readFileSync(path18.join(git.gitDir, "HEAD"), "utf8").trim();
+    const head = fs14.readFileSync(path18.join(git.gitDir, "HEAD"), "utf8").trim();
     if (/^[0-9a-f]{40,64}$/.test(head))
       return head;
     const ref = /^ref: (refs\/.+)$/.exec(head)?.[1];
@@ -18126,9 +18195,9 @@ var headSha2 = (repo) => {
       return null;
     const common = path18.dirname(repo.location.dir);
     try {
-      return fs13.readFileSync(path18.join(common, ref), "utf8").trim() || null;
+      return fs14.readFileSync(path18.join(common, ref), "utf8").trim() || null;
     } catch {}
-    const packed = fs13.readFileSync(path18.join(common, "packed-refs"), "utf8");
+    const packed = fs14.readFileSync(path18.join(common, "packed-refs"), "utf8");
     return new RegExp(`^([0-9a-f]{40,64}) ${ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m").exec(packed)?.[1] ?? null;
   } catch {
     return null;
@@ -18176,6 +18245,11 @@ var actionsIn = (cwd, command, dialect) => {
   }
   return out;
 };
+var inWorkitWorkspace = (dir) => {
+  const repo = repoAt(dir);
+  return repo !== null && isWorkitWorkspace(repo);
+};
+var rawDelivery = (cwd, command, dialect) => mentionsRawTool(command) && actionsIn(cwd, command, dialect).some(({ action }) => action.kind !== "commit" && action.kind !== "pr-read");
 var mentionsRawTool = (command) => /\b(?:git|gh|glab)\b/i.test(command);
 var dialectOf = (input) => (input.event.kind === "shell.pre" || input.event.kind === "shell.post" ? input.event.dialect : undefined) ?? "posix";
 function rawGitPre(input, command) {
@@ -18205,8 +18279,8 @@ function rawGitPre(input, command) {
 var deny = (reason) => ({ kind: "deny", reason, unblock: null });
 var NEXT_COMMAND = "next";
 var MARKER_TTL_SECONDS = 3600;
-var markerFile = (repo, session, key) => path18.join(repo.location.dir, "hooks", `commit-${createHash11("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
-var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash11("sha256").update(command).digest("hex")}`;
+var markerFile = (repo, session, key) => path18.join(repo.location.dir, "hooks", `commit-${createHash12("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
+var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash12("sha256").update(command).digest("hex")}`;
 function noteRawCommit(input, command, key) {
   try {
     if (!input.session.id || !/\bcommit\b/.test(command))
@@ -18216,8 +18290,8 @@ function noteRawCommit(input, command, key) {
       if (action.kind !== "commit")
         continue;
       const file = markerFile(repo, input.session.id, key);
-      fs13.mkdirSync(path18.dirname(file), { recursive: true });
-      fs13.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
+      fs14.mkdirSync(path18.dirname(file), { recursive: true });
+      fs14.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
 `);
     }
   } catch {}
@@ -18240,11 +18314,11 @@ var headCommit = (dir) => {
 var settle2 = (input, repo, file) => {
   let marker;
   try {
-    marker = JSON.parse(fs13.readFileSync(file, "utf8"));
+    marker = JSON.parse(fs14.readFileSync(file, "utf8"));
   } catch {
     return;
   }
-  fs13.rmSync(file, { force: true });
+  fs14.rmSync(file, { force: true });
   const session = input.session.id;
   const now = Date.now() / 1000;
   if (typeof marker.at !== "number" || now - marker.at > MARKER_TTL_SECONDS)
@@ -18293,18 +18367,292 @@ function settlePendingCommit(input) {
     if (!repo)
       return;
     const file = markerFile(repo, input.session.id, NEXT_COMMAND);
-    if (fs13.existsSync(file))
+    if (fs14.existsSync(file))
       settle2(input, repo, file);
   } catch {}
 }
+// packages/workit-core/src/hooks/skill-nudge.ts
+import { createHash as createHash13 } from "node:crypto";
+import fs15 from "node:fs";
+import path19 from "node:path";
+
+// packages/workit-core/src/core/skill-manifests.ts
+var WORKIT_METHOD_SKILLS = [
+  "workit-shape",
+  "workit-implement",
+  "workit-review",
+  "workit-debug",
+  "workit-ship",
+  "workit-continue",
+  "workit-bdd",
+  "workit-test-audit",
+  "workit-deslop",
+  "workit-fanout",
+  "workit-verify-app",
+  "workit-retro",
+  "workit-architecture"
+];
+var WORKIT_SKILL_ALIASES = {
+  "wk-shape": "workit-shape",
+  "wk-implement": "workit-implement",
+  "wk-review": "workit-review",
+  "wk-debug": "workit-debug",
+  "wk-ship": "workit-ship",
+  "wk-continue": "workit-continue",
+  "wk-bdd": "workit-bdd",
+  "wk-test-audit": "workit-test-audit",
+  "wk-deslop": "workit-deslop",
+  "wk-fanout": "workit-fanout",
+  "wk-verify-app": "workit-verify-app",
+  "wk-retro": "workit-retro",
+  "wk-architecture": "workit-architecture"
+};
+var skillLoadWording = (host, skill) => {
+  switch (host) {
+    case "claude-code":
+      return `call the Skill tool with \`workit:${skill.replace(/^workit-/, "")}\``;
+    case "opencode":
+      return `call the skill tool with \`${skill}\``;
+    default:
+      return `read the \`${skill}\` skill's SKILL.md and follow it`;
+  }
+};
+if (false) {}
+
+// packages/workit-core/src/hooks/skill-nudge.ts
+var USER_INVOKED = new Set(["workit-retro", "workit-architecture"]);
+var SKILL_HOST = {
+  claude_code: "claude-code",
+  opencode: "opencode",
+  codex_cli: "codex",
+  codex_desktop: "codex",
+  cursor: "cursor",
+  pi: "pi"
+};
+var PROMPT_INTENTS = [
+  [
+    "workit-debug",
+    /\b(flaky|regression|(?:is|are|got|looks) broken|debug (?:this|it|the|why)|fix (?:the|this|a) bug)\b/i
+  ],
+  [
+    "workit-continue",
+    /\b(pick up where|where (?:were|did) we|resume (?:the|this|my|our|work|where)|hand ?off)\b/i
+  ],
+  [
+    "workit-review",
+    /\b(blast radius|code review|review (?:the|this|my|PR|pr|#\d+|branch|diff|changes))\b/i
+  ],
+  [
+    "workit-ship",
+    /\b(ship (?:it|this|the)|babysit|open (?:a|the) (?:PR|pr|MR|mr)|merge (?:the|this|my) (?:PR|pr|MR|mr|branch)|(?:get|until|make) CI (?:is )?green)\b/i
+  ],
+  ["workit-bdd", /\b(BDD|TDD|acceptance criteria|Given\/When\/Then)(?![\w/])/],
+  ["workit-test-audit", /\b(test audit|audit the tests|tautolog\w*|weak tests)\b/i],
+  ["workit-deslop", /\b(deslop|slop|dead code)\b/i],
+  ["workit-fanout", /\b(fan(?: |-)?out|parallelize|parallel agents|swarm)\b/i],
+  ["workit-verify-app", /\b(verify the app|smoke test|prove it works)\b/i],
+  ["workit-retro", /\b(retro|retrospective)\b(?!\.\w)/i],
+  ["workit-architecture", /\b(deepen (?:the )?modules|architecture (?:review|pass|audit))\b/i],
+  [
+    "workit-shape",
+    /\b(brainstorm\w*|grill me|should we|let'?s plan|plan (?:out|how|the|a|for)|(?:write|draft) (?:a|the) spec)\b/i
+  ],
+  [
+    "workit-implement",
+    /\b(implement (?:the|this|a|it)|add (?:a|the) feature|build (?:a|an|the) (?:new )?(?:feature|command|verb|page|endpoint|component|cli|tool))\b/i
+  ]
+];
+var workitSkillOf = (name) => {
+  const bare = name.trim().replace(/^\//, "").toLowerCase();
+  const alias = WORKIT_SKILL_ALIASES[bare];
+  if (alias)
+    return alias;
+  const skill = bare.replace(/^workit:/, "workit-");
+  return WORKIT_METHOD_SKILLS.includes(skill) ? skill : null;
+};
+var promptTrigger = (prompt) => {
+  const text = prompt.replace(/```[\s\S]*?```/g, " ").slice(0, 4000);
+  for (const [skill, pattern] of PROMPT_INTENTS) {
+    const match = pattern.exec(text);
+    if (match)
+      return { skill, trigger: match[1] ?? match[0] };
+  }
+  return null;
+};
+var markerFile2 = (input, session) => {
+  const location = resolveStore(input.cwd);
+  if (location instanceof Error || !location.shared)
+    return null;
+  const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
+  return path19.join(location.dir, "hooks", `skills-${name}.json`);
+};
+var readMarker = (file) => {
+  try {
+    const value = JSON.parse(fs15.readFileSync(file, "utf8"));
+    return { nudged: value.nudged ?? [], loaded: value.loaded ?? [] };
+  } catch {
+    return { nudged: [], loaded: [] };
+  }
+};
+var writeMarker = (file, marker) => {
+  try {
+    fs15.mkdirSync(path19.dirname(file), { recursive: true });
+    fs15.writeFileSync(file, JSON.stringify(marker));
+  } catch {}
+};
+var loadedSkills = (cwd, session) => {
+  const ledger = readLedger(cwd);
+  const loaded = new Set;
+  if (!ledger.ok)
+    return loaded;
+  for (const row of ledger.value.rows)
+    if (row.type === "skill.loaded" && row.actor.session === session && typeof row.skill === "string")
+      loaded.add(row.skill);
+  return loaded;
+};
+var SKILL_FILE = /(?:^|[\\/])(workit-[a-z-]+)[\\/]SKILL\.md$/;
+var skillFileIn = (file) => SKILL_FILE.exec(file)?.[1] ?? null;
+var READERS = new Set([
+  "cat",
+  "sed",
+  "head",
+  "tail",
+  "less",
+  "more",
+  "bat",
+  "nl",
+  "get-content",
+  "gc",
+  "type"
+]);
+var skillReadIn = (command, dialect = "posix") => {
+  for (const { words } of segmentsOf(command, dialect)) {
+    if (!READERS.has((words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase()))
+      continue;
+    for (const word of words.slice(1)) {
+      const skill = skillFileIn(word);
+      if (skill)
+        return skill;
+    }
+  }
+  return null;
+};
+function recordSkillLoad(input, name, via) {
+  try {
+    const skill = workitSkillOf(name);
+    const session = input.session.id;
+    if (!skill || !session)
+      return;
+    if (!inWorkitWorkspace(input.cwd))
+      return;
+    const file = markerFile2(input, session);
+    if (!file)
+      return;
+    const marker = readMarker(file);
+    if (marker.loaded.includes(skill))
+      return;
+    writeMarker(file, { ...marker, loaded: [...marker.loaded, skill] });
+    if (loadedSkills(input.cwd, session).has(skill))
+      return;
+    appendHookObserved(input.cwd, {
+      type: "skill.loaded",
+      actor: { host: input.host, session, agentId: input.session.agentId },
+      skill,
+      via
+    });
+  } catch {}
+}
+var nudgeOnce = (input, session, skill, line) => {
+  const file = markerFile2(input, session);
+  if (!file)
+    return null;
+  const marker = readMarker(file);
+  if (marker.nudged.includes(skill) || marker.loaded.includes(skill))
+    return null;
+  if (loadedSkills(input.cwd, session).has(skill))
+    return null;
+  writeMarker(file, { ...marker, nudged: [...marker.nudged, skill] });
+  return line;
+};
+var nudgeText = (input, skill, why) => USER_INVOKED.has(skill) ? `Workit: ${why} looks like ${skill} work, which the user starts; offer it (/${skill.replace(/^workit-/, "wk-")}) rather than loading it.` : `Workit: ${why} looks like ${skill} work; if it is, ${skillLoadWording(SKILL_HOST[input.host], skill)} first.`;
+var promptLoads = (prompt) => /^\s*\/(?:skill:)?([\w:-]+)/.exec(prompt)?.[1] ?? /^\s*<skill name="([\w:-]+)"/.exec(prompt)?.[1] ?? /^\s*Load the (workit-[a-z-]+) skill with the skill tool\b/.exec(prompt)?.[1] ?? null;
+function promptNudge(input, prompt) {
+  try {
+    const session = input.session.id;
+    if (!prompt || !session || input.session.agentId)
+      return null;
+    const loads = promptLoads(prompt);
+    if (loads) {
+      recordSkillLoad(input, loads, "slash");
+      return null;
+    }
+    const hit = promptTrigger(prompt);
+    if (!hit || !inWorkitWorkspace(input.cwd))
+      return null;
+    return nudgeOnce(input, session, hit.skill, nudgeText(input, hit.skill, `this request ("${hit.trigger}")`));
+  } catch {
+    return null;
+  }
+}
+var WORKIT_DELIVERY = /^(?:pr (?:create|merge)|ci wait|git push)\b/;
+var SHELLS2 = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+var LAUNCHERS = new Set([
+  "npx",
+  "bunx",
+  "pnpx",
+  "-y",
+  "--yes",
+  "pnpm",
+  "dlx",
+  "exec",
+  "env",
+  "sudo",
+  "command"
+]);
+var runsWorkitDelivery = (command, dialect, depth = 0) => segmentsOf(command, dialect).some(({ words }) => {
+  const at = words.findIndex((word) => !/^\w+=/.test(word) && !LAUNCHERS.has(word));
+  if (at >= 0 && /(?:^|[\\/])workit(?:\.exe)?$|^@brainervirus\/workit-cli$/.test(words[at])) {
+    const args = words.slice(at + 1);
+    if (args.some((arg) => arg === "--help" || arg === "-h" || arg === "--dry-run"))
+      return false;
+    return WORKIT_DELIVERY.test(args.join(" "));
+  }
+  const shell = SHELLS2.has(words[at]?.split(/[\\/]/).at(-1) ?? "");
+  const script = shell && words[at + 1] === "-c" ? words[at + 2] : undefined;
+  return depth < 3 && script !== undefined && runsWorkitDelivery(script, "posix", depth + 1);
+});
+var isDeliveryCommand = (cwd, command, dialect = "posix") => rawDelivery(cwd, command, dialect) || runsWorkitDelivery(command, dialect) && inWorkitWorkspace(cwd);
+function shipNudge(input, command) {
+  try {
+    const session = input.session.id;
+    if (!session || input.session.agentId)
+      return null;
+    const dialect = input.event.kind === "shell.pre" ? input.event.dialect ?? "posix" : "posix";
+    if (!isDeliveryCommand(input.cwd, command, dialect))
+      return null;
+    return nudgeOnce(input, session, "workit-ship", nudgeText(input, "workit-ship", "this delivery step"));
+  } catch {
+    return null;
+  }
+}
+var withContextLine = (decision, line) => {
+  if (!line)
+    return decision;
+  if (decision.kind === "none")
+    return { kind: "context", text: line };
+  if (decision.kind === "context")
+    return { kind: "context", text: `${decision.text}
+${line}` };
+  return decision;
+};
 // packages/workit-core/src/hooks/hosts/fields.ts
 import { existsSync as existsSync6, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
-import path19 from "node:path";
+import path20 from "node:path";
 var isRecord4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path19.isAbsolute(value) || !existsSync6(value))
+  if (!nonEmpty2(value) || !path20.isAbsolute(value) || !existsSync6(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -18312,7 +18660,7 @@ var existingDirectory = (value) => {
     return null;
   }
 };
-var SHELLS2 = new Set(["sh", "bash", "zsh", "dash", "pwsh", "powershell", "cmd"]);
+var SHELLS3 = new Set(["sh", "bash", "zsh", "dash", "pwsh", "powershell", "cmd"]);
 var SCRIPT_FLAG2 = /^(?:-\w*c|-command|\/c)$/i;
 var quoteArg = (arg) => /^[\w@%+=:,./-]+$/.test(arg) ? arg : JSON.stringify(arg);
 var commandText = (value) => {
@@ -18324,7 +18672,7 @@ var commandText = (value) => {
   if (!argv.every((arg) => typeof arg === "string"))
     return null;
   const shell = argv[0].split(/[\\/]/).at(-1)?.replace(/\.exe$/i, "").toLowerCase() ?? "";
-  if (SHELLS2.has(shell))
+  if (SHELLS3.has(shell))
     for (let index = 1;index < argv.length - 1; index++) {
       if (SCRIPT_FLAG2.test(argv[index]))
         return nonEmpty2(argv[index + 1]) ? argv[index + 1] : null;
@@ -18355,30 +18703,49 @@ var WRITE_TOOLS = new Set([
 ]);
 var isWriteTool = (name) => typeof name === "string" && WRITE_TOOLS.has(name.toLowerCase().replace(/[_-]/g, ""));
 var PATH_KEYS = ["file_path", "filePath", "notebook_path", "path", "target_file", "file"];
+var PATCH_HEADER = /^[ \t]*\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/gm;
 var writePaths = (input) => {
   if (!isRecord4(input))
     return [];
   const paths = PATH_KEYS.map((key) => input[key]).filter(nonEmpty2);
   for (const value of Object.values(input))
     if (typeof value === "string")
-      for (const match of value.matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm))
+      for (const match of value.matchAll(PATCH_HEADER))
         paths.push(match[1].trim());
   return [...new Set(paths)];
 };
+var writeTargets = (input) => {
+  const paths = writePaths(input);
+  return paths.length > 0 ? paths : null;
+};
 // packages/workit-core/src/hooks/handle.ts
 var usable2 = (value) => value === "native" || value === "partial";
 var NONE4 = { kind: "none" };
+var resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn);
 var offered = new Set;
-var CLAUDE_WORKTREE_IMPLEMENTER = "workit:implementer";
-var CLAUDE_JUDGES = new Set(["workit:verifier", "workit:reviewer"]);
+var ROLES = {
+  implementer: "implementer",
+  verifier: "judge",
+  reviewer: "judge"
+};
+var workitRole = (descriptor, agentType) => {
+  const prefix = descriptor.subagents.agentPrefix;
+  const name = agentType.startsWith(prefix) ? agentType.slice(prefix.length) : "";
+  return Object.hasOwn(ROLES, name) ? ROLES[name] : null;
+};
 var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
-var subagentStartText = (host, session, descriptor, event) => {
-  if (host === "claude_code" && event.agentType === CLAUDE_WORKTREE_IMPLEMENTER)
-    return `Workit observed ${descriptor.label} subagent ${event.agentId} (${event.agentType}) working in its own git worktree: it may edit and commit there, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (e.g. feature/<slug>); branch policy hooks still deny protected or non-compliant branches. Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
-  const readOnly = `Workit observed ${descriptor.label} subagent ${event.agentId} (${event.agentType}) as read-only/agent-guided.`;
-  if (host === "claude_code" && event.agentType && CLAUDE_JUDGES.has(event.agentType) && event.agentId)
-    return `${readOnly} Its own Workit session is ${subagentSession(session, event.agentId)}: record verdicts with \`workit ledger verdict <result> --session ${subagentSession(session, event.agentId)} ...\` so the ledger tells it apart from the author.`;
-  return readOnly;
+var subagentStartText = (session, descriptor, event) => {
+  const role = workitRole(descriptor, event.agentType);
+  const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
+  if (role === "implementer") {
+    const where = descriptor.subagents.worktreeIsolation === "native" ? "working in its own git worktree: it may edit and commit there" : "as an implementer: it edits and commits only in its own git worktree (the lead makes one with `workit fanout worktree create <slice>`), never in the lead's checkout";
+    return `Workit observed ${who} ${where}, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (e.g. feature/<slug>); branch policy hooks still deny protected or non-compliant branches. Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+  }
+  const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
+  if (role !== "judge" || !event.agentId)
+    return readOnly;
+  const own = subagentSession(session, event.agentId);
+  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> --session ${own} ...\` so the ledger tells it apart from the author.`;
 };
 function handleHook(input, deps) {
   const { descriptor } = deps;
@@ -18394,18 +18761,22 @@ function handleHook(input, deps) {
       const advisory = usable2(descriptor.events["write.pre"].support) ? null : `Workit cannot gate file writes on ${descriptor.label} (no pre-write hook): before-write requirements (an open product choice, a missing plan) are advisory here, so settle them before editing.`;
       const addendum = [deps.addendum, advisory].filter(Boolean).join(`
 `) || null;
-      return {
-        kind: "context",
-        text: sessionContextText(input, descriptor, { offer, addendum })
-      };
+      const text = sessionContextText(input, descriptor, { offer, addendum });
+      if (resendsOnChange(descriptor))
+        seedTurnContext(input, descriptor);
+      return { kind: "context", text };
     }
     case "context.turn": {
       if (!usable2(descriptor.context.perTurn))
         return NONE4;
-      const text = turnContextText(input, descriptor);
-      return text ? { kind: "context", text } : NONE4;
+      const current = turnContextText(input, descriptor);
+      const text = resendsOnChange(descriptor) ? changedTurnContext(input, current) : current;
+      return withContextLine(text ? { kind: "context", text } : NONE4, promptNudge(input, event.prompt));
     }
     case "shell.pre": {
+      const skillRead = skillReadIn(event.command, event.dialect);
+      if (skillRead)
+        recordSkillLoad(input, skillRead, "read");
       const canDeny = usable2(descriptor.shellPolicy.deny);
       const policy = canDeny ? shellPolicy(input.cwd, event.command) : NONE4;
       if (policy.kind !== "none")
@@ -18421,7 +18792,7 @@ function handleHook(input, deps) {
       if (gate.kind === "deny")
         return gate;
       noteRawCommit(input, event.command, postTool ? callKey(event.toolUseId, event.command) : NEXT_COMMAND);
-      return raw;
+      return withContextLine(raw, shipNudge(input, event.command));
     }
     case "shell.post":
       if (usable2(descriptor.events["shell.post"].support))
@@ -18432,7 +18803,7 @@ function handleHook(input, deps) {
     case "subagent.start":
       return {
         kind: "context",
-        text: subagentStartText(input.host, input.session.id ?? null, descriptor, event)
+        text: subagentStartText(input.session.id ?? null, descriptor, event)
       };
     case "compact.pre":
       return {
@@ -18440,6 +18811,9 @@ function handleHook(input, deps) {
         userMessage: "Workit context may be stale after compaction; re-run inspection or resume before acting."
       };
     case "tool.pre":
+      if (event.skill)
+        recordSkillLoad(input, event.skill, "tool");
+      return NONE4;
     case "subagent.stop":
     case "prompt.submit":
     case "stop":
@@ -18490,24 +18864,26 @@ var CLAUDE_CODE_DESCRIPTOR = {
     "write.pre": { support: "native", native: "PreToolUse" },
     "shell.post": { support: "native", native: "PostToolUse" },
     "subagent.start": { support: "native", native: "SubagentStart" },
-    "subagent.stop": { support: "native", native: "SubagentStop" },
     "prompt.submit": { support: "native", native: "UserPromptSubmit" },
-    "compact.pre": { support: "partial", native: "PreCompact" },
-    stop: { support: "native", native: "Stop" }
+    "subagent.stop": { support: "none", native: null },
+    "compact.pre": { support: "none", native: null },
+    stop: { support: "none", native: null }
   },
   shellPolicy: { deny: "native", channel: "permissionDecision", failClosed: false },
   context: {
     sessionStart: "native",
     perTurn: "native",
     afterCompact: "native",
-    task: "session-bound"
+    task: "session-bound",
+    turnResend: "every-turn"
   },
   subagents: {
     identity: "native",
     parentBinding: "partial",
     blockStart: "none",
     worktreeIsolation: "native",
-    maxConcurrency: "undocumented"
+    maxConcurrency: "undocumented",
+    agentPrefix: "workit:"
   },
   provenance: { sessionId: "native", agentIdOnTool: "native", postToolObserve: "native" },
   interaction: { questions: "undocumented", writeBoundary: "partial" },
@@ -18525,13 +18901,13 @@ var CLAUDE_CODE_DESCRIPTOR = {
     },
     {
       name: "native_subagents",
-      surface: "SubagentStart/SubagentStop",
-      refs: ["SubagentStart", "SubagentStop"],
-      requires: ["event:subagent.start", "event:subagent.stop"],
-      observed: ["subagent.start", "subagent.stop"],
+      surface: "SubagentStart",
+      refs: ["SubagentStart"],
+      requires: ["event:subagent.start"],
+      observed: ["subagent.start"],
       assurance: "agent_guided",
       reason: "Claude Code reports stable agent identities, but SubagentStart cannot block or bind",
-      unavailableReason: "Claude Code subagent lifecycle hooks are unavailable"
+      unavailableReason: "Claude Code SubagentStart is unavailable"
     },
     {
       name: "fresh-context-review",
@@ -18582,7 +18958,7 @@ var eventOf = (name, value) => {
     case "SessionStart":
       return SOURCES.has(value.source) ? { ok: true, event: { kind: "session.start", source: value.source } } : { ok: false, error: "SessionStart source is required" };
     case "UserPromptSubmit":
-      return { ok: true, event: { kind: "context.turn" } };
+      return { ok: true, event: { kind: "context.turn", prompt: optionalText(value.prompt) } };
     case "PreToolUse": {
       if (!nonEmpty2(value.tool_name))
         return { ok: false, error: "tool_name is required" };
@@ -18592,10 +18968,20 @@ var eventOf = (name, value) => {
           event: {
             kind: "write.pre",
             tool: value.tool_name,
-            paths: writePaths(value.tool_input),
+            paths: writeTargets(value.tool_input),
             toolUseId
           }
         };
+      if (value.tool_name === "Skill")
+        return {
+          ok: true,
+          event: {
+            kind: "tool.pre",
+            tool: value.tool_name,
+            toolUseId,
+            skill: isRecord4(value.tool_input) ? optionalText(value.tool_input.skill) : null
+          }
+        };
       if (!SHELL_TOOLS.has(value.tool_name))
         return { ok: true, event: { kind: "tool.pre", tool: value.tool_name, toolUseId } };
       const command = toolCommand(value);
@@ -18730,39 +19116,40 @@ var claudeCodeAdapter = {
 function detectCodexSurface(env) {
   return env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || Boolean(env.CODEX_ELECTRON_RESOURCES_PATH) ? "codex_desktop" : "codex_cli";
 }
-var undocumented = { support: "undocumented", native: null };
 var CODEX_DESCRIPTOR = {
   host: "codex_cli",
   label: "Codex",
-  verifiedAgainst: "codex-cli 0.153.4; Codex Desktop 26.901.20858",
+  verifiedAgainst: "codex-cli 0.160.1 (hook JSON schemas in the binary); Codex Desktop 26.901.20858",
   docs: ["https://developers.openai.com/codex/hooks"],
   transport: "hook-process",
   events: {
     "session.start": { support: "native", native: "SessionStart" },
-    "context.turn": undocumented,
+    "context.turn": { support: "native", native: "UserPromptSubmit" },
     "shell.pre": { support: "native", native: "PreToolUse" },
     "tool.pre": { support: "native", native: "PreToolUse" },
-    "write.pre": { support: "undocumented", native: null },
+    "write.pre": { support: "native", native: "PreToolUse" },
     "shell.post": { support: "native", native: "PostToolUse" },
     "subagent.start": { support: "native", native: "SubagentStart" },
     "subagent.stop": { support: "native", native: "SubagentStop" },
-    "prompt.submit": undocumented,
+    "prompt.submit": { support: "native", native: "UserPromptSubmit" },
     "compact.pre": { support: "none", native: null },
-    stop: undocumented
+    stop: { support: "none", native: null }
   },
   shellPolicy: { deny: "native", channel: "permissionDecision", failClosed: false },
   context: {
     sessionStart: "native",
-    perTurn: "undocumented",
+    perTurn: "native",
     afterCompact: "native",
-    task: "single-active"
+    task: "single-active",
+    turnResend: "on-change"
   },
   subagents: {
     identity: "native",
     parentBinding: "none",
     blockStart: "none",
     worktreeIsolation: "undocumented",
-    maxConcurrency: "undocumented"
+    maxConcurrency: "undocumented",
+    agentPrefix: "workit-"
   },
   provenance: { sessionId: "native", agentIdOnTool: "partial", postToolObserve: "native" },
   interaction: { questions: "none", writeBoundary: "partial" },
@@ -18829,6 +19216,7 @@ var CODEX_DESCRIPTOR = {
 };
 var EVENTS2 = {
   SessionStart: "session.start",
+  UserPromptSubmit: "context.turn",
   PreToolUse: "shell.pre",
   PostToolUse: "shell.post",
   SubagentStart: "subagent.start",
@@ -18836,7 +19224,7 @@ var EVENTS2 = {
 };
 var SHELL_TOOLS2 = new Set(["bash", "unified-exec"]);
 var isShellTool = (name) => SHELL_TOOLS2.has(String(name).toLowerCase());
-var SOURCES2 = new Set(["startup", "resume", "clear", "compact"]);
+var SOURCES2 = new Set(["startup", "resume", "clear", "compact", "fork"]);
 var parseCodexHookInput = (value) => {
   if (!isRecord4(value) || !Object.hasOwn(EVENTS2, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
@@ -18863,6 +19251,7 @@ var parseCodexHookInput = (value) => {
       cwd,
       ...event === "SessionStart" ? { source: SOURCES2.has(String(value.source)) ? value.source : "resume" } : {},
       ...nonEmpty2(value.turn_id) ? { turn_id: value.turn_id } : {},
+      ...event === "UserPromptSubmit" ? { prompt: optionalText(value.prompt) } : {},
       ...nonEmpty2(value.tool_name) ? { tool_name: value.tool_name } : {},
       ...toolEvent ? { tool_input: value.tool_input } : {},
       ...event === "PostToolUse" && typeof value.tool_response === "string" ? { tool_response: value.tool_response } : {},
@@ -18882,13 +19271,20 @@ var protocolEvent = (input) => {
   switch (input.hook_event_name) {
     case "SessionStart":
       return { kind: "session.start", source: input.source };
+    case "UserPromptSubmit":
+      return { kind: "context.turn", prompt: input.prompt ?? null };
     case "PreToolUse": {
       const toolUseId = input.tool_use_id ?? null;
-      return isShellTool(input.tool_name) ? {
-        kind: "shell.pre",
-        command: input.command ?? "",
-        toolUseId
-      } : { kind: "tool.pre", tool: input.tool_name, toolUseId };
+      if (isShellTool(input.tool_name))
+        return { kind: "shell.pre", command: input.command ?? "", toolUseId };
+      if (isWriteTool(input.tool_name))
+        return {
+          kind: "write.pre",
+          tool: input.tool_name,
+          paths: writeTargets(input.tool_input),
+          toolUseId
+        };
+      return { kind: "tool.pre", tool: input.tool_name, toolUseId };
     }
     case "PostToolUse": {
       const toolUseId = input.tool_use_id ?? null;
@@ -18964,12 +19360,12 @@ var codexAdapter = {
     };
   },
   render: render2,
-  addendum: (input) => `<workit-codex-mutations>Codex MCP is read-only: unattested callers cannot mutate. Run workit verbs with the workit CLI on the shell (node_modules/.bin/workit, or npx -y @brainervirus/workit-cli): check, git branch|commit|push, pr, ci, stack, ledger, handoff; task-family mutations take --json${input.session.id ? ` --actor ${input.session.id}` : ""}. workit acts as this thread (CODEX_THREAD_ID${input.session.id ? `=${input.session.id}` : ""}) unless WORKIT_SESSION_ID is set. A verifier or reviewer records workit ledger verdict under a session the lead assigns (WORKIT_HOST=codex_cli WORKIT_SESSION_ID=<lead>-v<n>), never the author's. Merge and release need a workspace grant (workit grant show); a question answer is not host permission.</workit-codex-mutations>`
+  addendum: (input) => `<workit-codex-mutations>Codex MCP is read-only: unattested callers cannot mutate. Run workit verbs with the workit CLI on the shell (node_modules/.bin/workit, or npx -y @brainervirus/workit-cli): check, git branch|commit|push, pr, ci, stack, ledger, handoff; task-family mutations take --json${input.session.id ? ` --actor ${input.session.id}` : ""}. workit acts as this thread (CODEX_THREAD_ID${input.session.id ? `=${input.session.id}` : ""}) unless WORKIT_SESSION_ID is set. A verifier or reviewer records workit ledger verdict under its own session, never the author's: a workit-verifier or workit-reviewer agent uses the --session its SubagentStart context names; any other uses one the lead assigns (WORKIT_HOST=codex_cli WORKIT_SESSION_ID=<lead>-v<n>). Merge and release need a workspace grant (workit grant show); a question answer is not host permission.</workit-codex-mutations>`
 };
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import path20 from "node:path";
-var undocumented2 = { support: "undocumented", native: null };
+import path21 from "node:path";
+var undocumented = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
   host: "cursor",
@@ -18983,26 +19379,28 @@ var CURSOR_DESCRIPTOR = {
     "shell.pre": { support: "native", native: "beforeShellExecution" },
     "tool.pre": { support: "native", native: "preToolUse" },
     "write.pre": { support: "partial", native: "preToolUse" },
-    "shell.post": undocumented2,
+    "shell.post": undocumented,
     "subagent.start": { support: "native", native: "subagentStart" },
     "subagent.stop": { support: "partial", native: "subagentStop" },
-    "prompt.submit": undocumented2,
+    "prompt.submit": undocumented,
     "compact.pre": { support: "partial", native: "preCompact" },
-    stop: undocumented2
+    stop: none
   },
   shellPolicy: { deny: "native", channel: "exit2+json", failClosed: true },
   context: {
     sessionStart: "native",
     perTurn: "none",
     afterCompact: "partial",
-    task: "single-active"
+    task: "single-active",
+    turnResend: "every-turn"
   },
   subagents: {
     identity: "native",
     parentBinding: "native",
     blockStart: "native",
     worktreeIsolation: "undocumented",
-    maxConcurrency: "undocumented"
+    maxConcurrency: "undocumented",
+    agentPrefix: "workit-"
   },
   provenance: {
     sessionId: "native",
@@ -19127,7 +19525,7 @@ var protocolEvent2 = (input) => {
       return isWriteTool(input.tool_name) ? {
         kind: "write.pre",
         tool: input.tool_name ?? "",
-        paths: writePaths(input.tool_input),
+        paths: writeTargets(input.tool_input),
         toolUseId: null
       } : { kind: "tool.pre", tool: input.tool_name ?? "", toolUseId: null };
     case "subagentStart":
@@ -19149,7 +19547,7 @@ var protocolEvent2 = (input) => {
       return { kind: "compact.pre", trigger: "auto" };
   }
 };
-var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path20.sep) ? root : `${root}${path20.sep}`);
+var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path21.sep) ? root : `${root}${path21.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")