@brainervirus/workit-core 0.4.0

package/scripts/install-opencode-plugin.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Install OpenCode plugin: file:// pin to monorepo (or share clone) + native skill/command links.
+set -euo pipefail
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+ROOT="$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)"
+SHARE="${HOME}/.local/share/workflow-toolkit"
+DEV_DEFAULT="${HOME}/Documents/projects/personal/workflow-toolkit"
+DEV="${WORKFLOW_TOOLKIT_DEV:-$DEV_DEFAULT}"
+CONFIG="${HOME}/.config/opencode/opencode.json"
+
+chmod +x "$ROOT/scripts/sync-runtime.sh"
+WORKFLOW_TOOLKIT_DEV="$ROOT" "$ROOT/scripts/sync-runtime.sh"
+
+# Prefer monorepo with .git. file:// pins skip opencode's bundled npm installer —
+# git+file:// installs an EMPTY cache dir and fails silently, so the plugin never
+# loads after restart. The pinned entry resolves via packages/workit-opencode/package.json main.
+if [ -d "${DEV}/.git" ] && [ -f "${DEV}/packages/workit-opencode/src/plugin.ts" ]; then
+  PIN="file://${DEV}/packages/workit-opencode/src/plugin.ts"
+elif [ -d "${SHARE}/.git" ] && [ -f "${SHARE}/packages/workit-opencode/src/plugin.ts" ]; then
+  PIN="file://${SHARE}/packages/workit-opencode/src/plugin.ts"
+else
+  # Last resort: ensure share is a clone, then pin it
+  if [ ! -d "${SHARE}/.git" ]; then
+    TMP=$(mktemp -d)
+    git clone --depth 1 "git@github.com:${WORKFLOW_TOOLKIT_REPO:-BrainerVirus/workit}.git" "$TMP"
+    rsync -a --delete --exclude node_modules --exclude cursor/mcp/node_modules "$TMP/" "$SHARE/"
+    rm -rf "$TMP"
+  fi
+  PIN="file://${SHARE}/packages/workit-opencode/src/plugin.ts"
+fi
+
+mkdir -p "$(dirname "$CONFIG")"
+[ -f "$CONFIG" ] || printf '%s\n' "{}" >"$CONFIG"
+
+CONFIG_PATH="$CONFIG" PIN_PATH="$PIN" bun -e '
+import fs from "node:fs";
+const path = process.env.CONFIG_PATH!;
+const pin = process.env.PIN_PATH!;
+const data = JSON.parse(fs.readFileSync(path, "utf8"));
+let plugins = data.plugin || [];
+if (typeof plugins === "string") plugins = [plugins];
+// Drop stale workflow-toolkit pins — the new file:// pin is written fresh.
+data.plugin = plugins.filter((p) => !String(p).includes("workflow-toolkit"));
+data.plugin.push(pin);
+// Drop share skills.paths — native ~/.config/opencode/skills links avoid triple-load dups
+const skills = data.skills;
+if (skills && typeof skills === "object") {
+  skills.paths = (skills.paths || []).filter((p) => !String(p).includes("workflow-toolkit"));
+  data.skills = skills;
+}
+fs.writeFileSync(path, JSON.stringify(data, null, 2) + "\n");
+console.log("Pinned:", pin);
+console.log("Native skills/commands via ~/.config/opencode/{skills,commands}");
+'
+
+# file:// pin already ships skills + registers /wk-* via plugin config.
+# Remove leftover native links so OpenCode does not warn about duplicate skill names.
+find "${HOME}/.config/opencode/skills" -maxdepth 1 -name 'wf-*' -exec rm -f {} + 2>/dev/null || true
+find "${HOME}/.config/opencode/skill" -maxdepth 1 -name 'wf-*' -exec rm -f {} + 2>/dev/null || true
+find "${HOME}/.config/opencode/commands" -maxdepth 1 -name 'wf-*.md' -exec rm -f {} + 2>/dev/null || true
+find "${HOME}/.config/opencode/command" -maxdepth 1 -name 'wf-*.md' -exec rm -f {} + 2>/dev/null || true
+rm -f "${HOME}/.config/opencode/plugins/workflow-toolkit.ts"
+rm -rf "${HOME}/.cache/opencode/packages/workflow-toolkit-opencode@"* 2>/dev/null || true
+
+# Post-install verification: file:// pins skip the installer, so a missing/empty
+# pinned entry is a silent no-op. Fail loudly instead of pretending it worked.
+PLUGIN_ENTRY="${PIN#file://}"
+if [ ! -s "$PLUGIN_ENTRY" ]; then
+  echo "FATAL: pinned plugin entry missing or empty: $PLUGIN_ENTRY" >&2
+  echo "The file:// pin written to $CONFIG will not load after restart." >&2
+  echo "Restore the monorepo (or fix WORKFLOW_TOOLKIT_DEV) and re-run this script." >&2
+  exit 1
+fi
+
+echo "OpenCode install done. Fully quit all opencode processes, then restart."

package/scripts/pr-create.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/pr-create.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../src/core/ports/pr-create.ts" "$@"

package/scripts/pr-ready-context.sh

@@ -0,0 +1,88 @@
+#!/bin/sh
+
+set -u
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$SCRIPT_DIR/_shared/common.sh"
+
+cd "$(repo_root)" || exit 1
+
+auto_range=false
+if [ "${1:-}" != "" ]; then
+  range=$1
+else
+  auto_range=true
+  if ! resolve_pr_branch_context; then
+    exit 1
+  fi
+  range=$PR_RANGE
+fi
+
+print_section "Repository"
+printf 'root: %s\n' "$(pwd)"
+printf 'branch: %s\n' "$(current_branch)"
+printf 'range: %s\n' "$range"
+if [ "$auto_range" = true ]; then
+  printf 'base_ref: %s\n' "$PR_BASE_REF"
+  printf 'merge_base: %s\n' "$PR_MERGE_BASE"
+  printf 'diff_range: %s\n' "$PR_DIFF_RANGE"
+  printf 'range_mode: branch-exclusive\n'
+  if [ "${PR_SYNC_NOTES:-}" != "" ]; then
+    printf 'git_sync: %s\n' "$PR_SYNC_NOTES"
+  fi
+fi
+
+print_section "Working Tree"
+git status --short 2>&1 || true
+
+print_section "Commits"
+commit_log_for_range "$range"
+
+diff_range=$range
+if [ "$auto_range" = true ]; then
+  diff_range=$PR_DIFF_RANGE
+fi
+
+print_section "Diff Stat"
+diff_stat_for_range "$diff_range"
+
+print_section "Changed Files"
+changed_files_for_range "$diff_range"
+
+print_section "PR Template"
+template=$(find_pr_template || true)
+if [ "$template" != "" ]; then
+  printf 'template_path: %s\n\n' "$template"
+  sed -n '1,220p' "$template"
+else
+  printf 'template_path: none\n\n'
+  fallback_pr_template
+fi
+
+print_section "Recent Validation Signals"
+if [ -f package.json ]; then
+  printf 'package.json detected. Common scripts:\n'
+  node -e "const p=require('./package.json'); for (const k of ['lint','format:check','test','build']) if (p.scripts&&p.scripts[k]) console.log(k+': '+p.scripts[k])" 2>/dev/null || true
+fi
+if [ -f Cargo.toml ] || [ -f src-tauri/Cargo.toml ]; then
+  printf 'Rust project detected.\n'
+fi
+
+print_section "VCS Config"
+RES=$(bash "$SCRIPT_DIR/vcs/config.sh" resolve 2>/dev/null || true)
+if [ -n "$RES" ]; then
+  printf '%s\n' "$RES" | bun -e 'const r = JSON.parse(await Bun.stdin.text()); console.log("workspace: " + String(r.workspace_name || "none")); console.log("provider: " + String(r.provider || "gitlab"))'
+fi
+if bash "$SCRIPT_DIR/vcs/config.sh" summary 2>/dev/null; then
+  :
+else
+  printf 'vcs: not configured — run /wk-init action vcs_scaffold\n'
+fi
+
+print_section "Merged PR Style"
+STYLE=$(bash "$SCRIPT_DIR/vcs/merged-style.sh" 6 2>/dev/null || true)
+if [ -n "$STYLE" ]; then
+  printf '%s\n' "$STYLE"
+else
+  printf 'style_hints: Configure VCS token to load your recent merged MR/PR examples\n'
+fi

package/scripts/present/ascii-wireframe.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/present-ascii.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/present-ascii.ts"

package/scripts/present/flow-diagram.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/present-flow.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/present-flow.ts"

package/scripts/release-notes-context.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+
+set -u
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$SCRIPT_DIR/_shared/common.sh"
+
+cd "$(repo_root)" || exit 1
+
+requested="${1:-}"
+if [ -z "$requested" ]; then
+  printf 'ERROR: release tag or range required\n' >&2
+  exit 1
+fi
+range=$(range_arg_or_default "$requested")
+
+print_section "Repository"
+printf 'root: %s\n' "$(pwd)"
+printf 'branch: %s\n' "$(current_branch)"
+printf 'requested: %s\n' "${requested:-none}"
+printf 'range: %s\n' "$range"
+
+print_section "Tags"
+git tag --sort=-creatordate 2>/dev/null | sed -n '1,20p' || true
+
+print_section "Commits"
+commit_log_for_range "$range"
+
+print_section "Diff Stat"
+diff_stat_for_range "$range"
+
+print_section "Changed Files"
+changed_files_for_range "$range"
+
+print_section "Existing Release Files"
+for path in CHANGELOG.md RELEASE_NOTES.md .github/releases.md; do
+  if [ -f "$path" ]; then
+    printf '%s\n' "$path"
+  fi
+done

package/scripts/rewrite-workspace-deps.ts

@@ -0,0 +1,17 @@
+#!/usr/bin/env bun
+// Rewrite workspace:* core deps to ^<released version> in the platform packages
+// before publish: neither npm nor bun rewrites the protocol, so a packed tarball
+// with workspace:* silently drops the core dependency. Runs as semantic-release
+// prepareCmd (after the version bumps, before the npm publish phase).
+import { readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const root = process.argv[2] ? resolve(process.argv[2]) : resolve(import.meta.dir, "..", "..", "..");
+const core = JSON.parse(readFileSync(resolve(root, "packages/workit-core/package.json"), "utf8"));
+for (const pkg of ["workit-opencode", "workit-cursor", "workit-cli"]) {
+  const file = resolve(root, `packages/${pkg}/package.json`);
+  const data = JSON.parse(readFileSync(file, "utf8"));
+  if (data.dependencies?.["@brainervirus/workit-core"] !== "workspace:*") continue;
+  data.dependencies["@brainervirus/workit-core"] = `^${core.version}`;
+  writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`);
+}

package/scripts/run-cursor-mcp.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Stable entrypoint for Cursor MCP deeplink / ~/.cursor/mcp.json
+# Prefer the installed plugin copy (has node_modules); fall back to share.
+set -euo pipefail
+PLUGIN_MCP="${HOME}/.cursor/plugins/local/workflow-toolkit/mcp/run-server.sh"
+SHARE_MCP="${HOME}/.local/share/workflow-toolkit/packages/workit-cursor/mcp/run-server.sh"
+if [ -x "$PLUGIN_MCP" ]; then
+  exec "$PLUGIN_MCP" "$@"
+fi
+exec "$SHARE_MCP" "$@"

package/scripts/sync-runtime.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Sync workit runtime for Cursor + OpenCode.
+# Prefer local monorepo (dev) when present; otherwise git-pull the share clone.
+set -euo pipefail
+
+SHARE="${HOME}/.local/share/workflow-toolkit"
+PLUGIN_DIR="${HOME}/.cursor/plugins/local/workflow-toolkit"
+OPENCODE_PLUGINS="${HOME}/.config/opencode/plugins"
+DEV_DEFAULT="${HOME}/Documents/projects/personal/workflow-toolkit"
+DEV="${WORKFLOW_TOOLKIT_DEV:-$DEV_DEFAULT}"
+REPO_SLUG="${WORKFLOW_TOOLKIT_REPO:-BrainerVirus/workit}"
+LOCK="${XDG_RUNTIME_DIR:-/tmp}/workflow-toolkit-sync.lock"
+
+exec 9>"$LOCK"
+if ! flock -n 9; then
+  exit 0
+fi
+
+SRC=""
+if [ -f "${DEV}/packages/workit-opencode/src/plugin.ts" ] && [ -d "${DEV}/packages/workit-cursor/.cursor-plugin" ]; then
+  SRC="$DEV"
+elif [ -d "${SHARE}/.git" ]; then
+  git -C "$SHARE" fetch --quiet origin 2>/dev/null || true
+  git -C "$SHARE" pull --ff-only --quiet origin main 2>/dev/null || true
+  SRC="$SHARE"
+elif [ ! -d "${SHARE}/packages/workit-core/src" ]; then
+  mkdir -p "$(dirname "$SHARE")"
+  git clone --depth 1 "git@github.com:${REPO_SLUG}.git" "$SHARE" 2>/dev/null || exit 0
+  SRC="$SHARE"
+else
+  SRC="$SHARE"
+fi
+
+if [ "$SRC" != "$SHARE" ]; then
+  mkdir -p "$SHARE"
+  # Keep .git if share is a clone; never wipe it when syncing from the monorepo
+  rsync -a --delete \
+    --exclude '.git' \
+    --exclude 'node_modules' \
+    --exclude 'cursor/mcp/node_modules' \
+    --exclude '.cache' \
+    "$SRC/" "$SHARE/"
+fi
+
+# Cursor IDE package (real directory)
+mkdir -p "${HOME}/.cursor/plugins/local"
+mkdir -p "$PLUGIN_DIR"
+rsync -a --delete \
+  --exclude 'mcp/node_modules' \
+  "$SHARE/packages/workit-cursor/" "$PLUGIN_DIR/"
+# Vendored skills for Cursor (same folder layout as OpenCode registration)
+mkdir -p "$PLUGIN_DIR/vendor/superpowers"
+if [ -d "$SHARE/packages/workit-core/vendor/superpowers/skills" ]; then
+  rsync -a --delete "$SHARE/packages/workit-core/vendor/superpowers/skills" "$PLUGIN_DIR/vendor/superpowers/"
+fi
+# Canonical user rules -> Cursor .mdc (compiled by the shared core)
+CONFIG_RULES_DIR="${HOME}/.config/workflow-toolkit/rules"
+if [ -d "$CONFIG_RULES_DIR" ]; then
+  "$HOME/.bun/bin/bun" -e "
+    import('${SHARE}/packages/workit-core/src/core/rules.ts').then(async ({ writeCompiledCursorRules }) => {
+      writeCompiledCursorRules('${PLUGIN_DIR}/rules');
+    });
+  " >/dev/null 2>&1 || true
+fi
+printf '%s\n' "$SHARE/packages/workit-core" >"$PLUGIN_DIR/.workflow-toolkit-root"
+chmod +x "$PLUGIN_DIR/hooks/session-start" "$PLUGIN_DIR/mcp/run-server.sh" 2>/dev/null || true
+
+if [ ! -d "$PLUGIN_DIR/mcp/node_modules" ]; then
+  (cd "$PLUGIN_DIR/mcp" && npm install --silent) || true
+fi
+
+# Share MCP also needs deps when launched via run-cursor-mcp fallback
+if [ ! -d "$SHARE/packages/workit-cursor/mcp/node_modules" ]; then
+  (cd "$SHARE/packages/workit-cursor/mcp" && npm install --silent) || true
+fi
+
+# Remove broken TLA live-loader if present (OpenCode ignored it; /wk-* vanished)
+rm -f "${OPENCODE_PLUGINS}/workflow-toolkit.ts"
+
+# Ensure OpenCode has plugin peer dep
+PKG="${HOME}/.config/opencode/package.json"
+if [ -f "$PKG" ]; then
+  PKG_PATH="$PKG" bun -e '
+import fs from "node:fs";
+const path = process.env.PKG_PATH!;
+const data = JSON.parse(fs.readFileSync(path, "utf8"));
+data.dependencies = data.dependencies ?? {};
+data.dependencies["@opencode-ai/plugin"] = data.dependencies["@opencode-ai/plugin"] ?? "1.17.7";
+fs.writeFileSync(path, JSON.stringify(data, null, 2) + "\n");
+' || true
+fi
+
+# Drop bun package cache so old github/file installs cannot shadow file:// plugin.ts
+rm -rf "${HOME}/.cache/opencode/packages/workflow-toolkit-opencode@"* 2>/dev/null || true
+
+exit 0

package/scripts/update-superpowers.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Re-sync vendored Superpowers skills from upstream. Never pushes or commits.
+set -euo pipefail
+
+REPO="https://github.com/obra/superpowers.git"
+VENDOR="vendor/superpowers"
+PIN=""
+for arg in "$@"; do
+  case "$arg" in
+    --https) REPO="https://github.com/obra/superpowers.git" ;;
+    --ssh) REPO="git@github.com:obra/superpowers.git" ;;
+    --pin=*) PIN="${arg#--pin=}" ;;
+    *) if [ -z "$PIN" ]; then PIN="$arg"; fi ;;
+  esac
+done
+
+ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
+STAGE="$(mktemp -d)"
+trap 'rm -rf "$STAGE"' EXIT
+
+echo "Cloning upstream..."
+git clone --quiet --depth 1 "$REPO" "$STAGE/sp"
+cd "$STAGE/sp"
+if [ -n "$PIN" ]; then
+  git fetch --quiet --depth 1 origin "refs/tags/$PIN" 2>/dev/null || {
+    echo "ERROR: pin $PIN not found upstream" >&2
+    exit 1
+  }
+  git checkout --quiet "$PIN"
+fi
+VERSION="$(grep -m1 '"version"' package.json | sed -E 's/.*"version": "([^"]+)".*/\1/')"
+
+cd "$ROOT"
+rm -rf "$VENDOR/skills"
+mkdir -p "$VENDOR"
+cp -R "$STAGE/sp/skills" "$VENDOR/skills"
+
+# Patch vendored skills to the toolkit's docs layout and contract rules.
+# The upstream skills teach docs/superpowers/... and the forbidden
+# "Two execution options" menu — both overridden by our contract.
+find "$VENDOR/skills" -type f \( -name '*.md' -o -name '*.ts' \) -print0 | while IFS= read -r -d '' f; do
+  sed -i \
+    -e 's|docs/superpowers/plans/YYYY-MM-DD-<feature-name>.md|docs/<slug>/plan.md|g' \
+    -e 's|docs/superpowers/plans/<filename>.md|docs/<slug>/plan.md|g' \
+    -e 's|docs/superpowers/plans/feature-plan.md|docs/<slug>/plan.md|g' \
+    -e 's|docs/superpowers/plans/deployment-plan.md|docs/deployment-plan/plan.md|g' \
+    -e 's|docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md|docs/<slug>/spec.md|g' \
+    -e 's|docs/superpowers/specs/|docs/<slug>/|g' \
+    -e 's|docs/superpowers/plans/|docs/<slug>/|g' \
+    -e 's|"Plan complete and saved to `docs/<slug>/plan.md`. Two execution options:\*\*|"Plan complete and saved to `docs/<slug>/plan.md`.**|g' \
+    "$f"
+done
+
+printf '%s\n' "$VERSION" > "$VENDOR/VERSION"
+echo "Vendored superpowers $VERSION -> $VENDOR (patched to docs/<slug>/ layout)"
+echo "Review with: git status && git diff --stat"

package/scripts/vcs/config.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/vcs-config.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/vcs-config.ts" "$@"

package/scripts/vcs/merged-style.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/vcs-merged-style.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/vcs-merged-style.ts" "$@"

package/scripts/vcs/token-create-urls.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/vcs-token-create-urls.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/vcs-token-create-urls.ts" "$@"

package/scripts/vcs/verify-token.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/vcs-verify-token.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/vcs-verify-token.ts" "$@"

package/scripts/verify-project.sh

@@ -0,0 +1,140 @@
+#!/bin/sh
+
+set -u
+
+root=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+cd "$root" || exit 1
+
+dry_run=false
+case " ${*:-} " in
+  *" --dry-run "*) dry_run=true ;;
+  *" dry-run "*) dry_run=true ;;
+esac
+
+passed=0
+failed=0
+skipped=0
+
+run_check() {
+  label=$1
+  shift
+  printf '\n## %s\n\n' "$label"
+  printf 'command: %s\n\n' "$*"
+  if [ "$dry_run" = true ]; then
+    printf 'status: skipped (dry run)\n'
+    skipped=$((skipped + 1))
+    return 0
+  fi
+  "$@"
+  code=$?
+  if [ "$code" -eq 0 ]; then
+    printf '\nstatus: pass\n'
+    passed=$((passed + 1))
+  else
+    printf '\nstatus: fail (exit %s)\n' "$code"
+    failed=$((failed + 1))
+  fi
+  return 0
+}
+
+skip_check() {
+  label=$1
+  reason=$2
+  printf '\n## %s\n\nstatus: skipped (%s)\n' "$label" "$reason"
+  skipped=$((skipped + 1))
+}
+
+has_script() {
+  name=$1
+  [ -f package.json ] || return 1
+  node -e "const p=require('./package.json'); process.exit(p.scripts && p.scripts['$name'] ? 0 : 1)" >/dev/null 2>&1
+}
+
+package_runner() {
+  if [ -f pnpm-lock.yaml ] || grep -q '"packageManager"[[:space:]]*:[[:space:]]*"pnpm' package.json 2>/dev/null; then
+    printf 'pnpm'
+  elif [ -f yarn.lock ]; then
+    printf 'yarn'
+  elif [ -f package-lock.json ]; then
+    printf 'npm'
+  else
+    printf 'npm'
+  fi
+}
+
+printf '# Verification Context\n'
+printf '\nroot: %s\n' "$root"
+printf 'dry_run: %s\n' "$dry_run"
+
+if [ -f package.json ]; then
+  runner=$(package_runner)
+  for script in lint format:check test build; do
+    if has_script "$script"; then
+      if [ "$runner" = "npm" ]; then
+        run_check "$script" npm run "$script"
+      else
+        run_check "$script" "$runner" "$script"
+      fi
+    else
+      skip_check "$script" "package.json has no $script script"
+    fi
+  done
+else
+  skip_check "javascript" "package.json not found"
+fi
+
+cargo_manifest=""
+if [ -f Cargo.toml ]; then
+  cargo_manifest="Cargo.toml"
+elif [ -f src-tauri/Cargo.toml ]; then
+  cargo_manifest="src-tauri/Cargo.toml"
+fi
+
+if [ "$cargo_manifest" != "" ]; then
+  run_check "cargo fmt" cargo fmt --manifest-path "$cargo_manifest" -- --check
+  run_check "cargo clippy" cargo clippy --manifest-path "$cargo_manifest" --all-targets -- -D warnings
+  run_check "cargo test" cargo test --manifest-path "$cargo_manifest" --all-targets
+else
+  skip_check "rust" "Cargo.toml not found"
+fi
+
+if [ -f pyproject.toml ] || [ -f pytest.ini ] || [ -d tests ]; then
+  if command -v pytest >/dev/null 2>&1; then
+    run_check "pytest" pytest
+  else
+    skip_check "pytest" "pytest not available"
+  fi
+  if command -v ruff >/dev/null 2>&1; then
+    run_check "ruff check" ruff check .
+  else
+    skip_check "ruff check" "ruff not available"
+  fi
+fi
+
+printf '\n## CHANGELOG.md format\n\n'
+printf 'command: grep -qi "## [Unreleased]" CHANGELOG.md\n\n'
+
+if [ "$dry_run" = true ]; then
+  printf 'status: skipped (dry run)\n'
+  skipped=$((skipped + 1))
+elif [ -f CHANGELOG.md ]; then
+  if grep -qi '## \[Unreleased\]' CHANGELOG.md; then
+    printf 'status: pass\n'
+    passed=$((passed + 1))
+  else
+    printf 'status: fail (missing ## [Unreleased])\n'
+    failed=$((failed + 1))
+  fi
+else
+  printf 'status: fail (missing CHANGELOG.md)\n'
+  failed=$((failed + 1))
+fi
+
+printf '\n# Summary\n\n'
+printf 'passed: %s\n' "$passed"
+printf 'failed: %s\n' "$failed"
+printf 'skipped: %s\n' "$skipped"
+
+if [ "$failed" -gt 0 ]; then
+  exit 1
+fi

package/scripts/youtrack/api.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/youtrack-api.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/youtrack-api.ts" "$@"

package/scripts/youtrack/config.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/youtrack-config.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/youtrack-config.ts" "$@"

package/scripts/youtrack/greeting.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/youtrack-greeting.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/youtrack-greeting.ts" "$@"

package/scripts/youtrack/parse-duration.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/youtrack-parse-duration.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/youtrack-parse-duration.ts" "$@"

package/scripts/youtrack/token-create-url.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/youtrack-token-create-url.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/youtrack-token-create-url.ts" "$@"

package/scripts/youtrack/verify-token.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/youtrack-verify-token.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/youtrack-verify-token.ts" "$@"

package/scripts/youtrack/work-date-ms.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Ported to TS — CLI contract kept: execs bun <core>/ports/youtrack-work-date-ms.ts
+set -euo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec bun "$SCRIPT_DIR/../../src/core/ports/youtrack-work-date-ms.ts" "$@"

package/skills/wk-changelog/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: wk-changelog
+description: Preview and apply a Keep a Changelog update.
+---
+
+# Changelog
+
+1. Load this skill explicitly through OpenCode's `skill` tool.
+2. Call the read-only `workflow_changelog_context` context tool; its result is ground truth.
+3. Draft the exact insertion preview, including target heading, categories, and bullets.
+4. Use native `question` with concise choices and allow a custom answer before changing the file.
+5. Call `workflow_changelog_apply` only after approval with `confirmed: true`.
+6. Report the structured success, failure stage, or partial result; never infer success.
+
+Target `## [Unreleased]` unless the user requests a release. Use only Added, Changed, Deprecated, Removed, Fixed, or Security; group user-visible behavior and skip internal-only work. The apply tool must merge into existing category headings, preserve all unrelated lines, and skip duplicate bullets. If normalization is needed, include it in the same preview and approval. Do not hand-edit the changelog, version packages, tag, or commit. `todowrite` and `task` are unnecessary here.