@brainervirus/workit-cursor 0.8.7 → 0.8.9

package/dist/mcp-server.js

@@ -21835,6 +21835,25 @@ var init_support_matrix = __esm(() => {
   };
 });
 
+// packages/workit-core/src/core/package-root.ts
+import { existsSync as existsSync4 } from "node:fs";
+import path8 from "node:path";
+import { fileURLToPath } from "node:url";
+var packageRoot = () => {
+  let dir = path8.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const parent = path8.dirname(dir);
+    if (existsSync4(path8.join(dir, "package.json")) || parent === dir)
+      return dir;
+    dir = parent;
+  }
+}, assetRoot = () => {
+  const root = packageRoot();
+  const assets = path8.join(root, "assets");
+  return existsSync4(assets) ? assets : root;
+};
+var init_package_root = () => {};
+
 // packages/workit-core/src/core/registration.ts
 function isWorkitPlugin(value) {
   const s = String(value).replaceAll("\\", "/");
@@ -21864,18 +21883,18 @@ var named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_
 var init_registration = () => {};
 
 // packages/workit-core/src/core/skill-manifests.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
-import path8 from "node:path";
-var CANONICAL_SKILLS, skillManifestNames = (root) => existsSync4(root) ? readdirSync4(root).filter((name) => existsSync4(path8.join(root, name, "SKILL.md"))).sort() : [], validateSkillManifests = (root, expected, label) => {
+import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
+import path9 from "node:path";
+var CANONICAL_SKILLS, skillManifestNames = (root) => existsSync5(root) ? readdirSync4(root).filter((name) => existsSync5(path9.join(root, name, "SKILL.md"))).sort() : [], validateSkillManifests = (root, expected, label) => {
   const actual = skillManifestNames(root);
   const missing = expected.filter((name) => !actual.includes(name));
   const extra = actual.filter((name) => !expected.includes(name));
   return missing.length === 0 && extra.length === 0 ? null : `${label} mismatch at ${root} (missing: ${missing.join(", ") || "none"}; extra: ${extra.join(", ") || "none"})`;
 }, validateCursorSkills = (pluginDir) => {
-  const workit = validateSkillManifests(path8.join(pluginDir, "skills"), CANONICAL_SKILLS.workit, "Cursor Workit skills");
+  const workit = validateSkillManifests(path9.join(pluginDir, "skills"), CANONICAL_SKILLS.workit, "Cursor Workit skills");
   if (workit)
     return workit;
-  const vendor = path8.join(pluginDir, "vendor/superpowers/skills");
+  const vendor = path9.join(pluginDir, "vendor/superpowers/skills");
   const superpowers = validateSkillManifests(vendor, CANONICAL_SKILLS.superpowers, "Cursor Superpowers skills");
   if (superpowers)
     return superpowers;
@@ -21883,7 +21902,7 @@ var CANONICAL_SKILLS, skillManifestNames = (root) => existsSync4(root) ? readdir
   while (pending.length > 0) {
     const dir = pending.pop();
     for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-      const file = path8.join(dir, entry.name);
+      const file = path9.join(dir, entry.name);
       if (entry.isDirectory())
         pending.push(file);
       else if ((statSync2(file).mode & 73) !== 0 || readFileSync6(file).subarray(0, 2).toString("latin1") === "#!") {
@@ -21931,15 +21950,15 @@ var init_skill_manifests = __esm(() => {
 
 // packages/workit-core/src/core/doctor.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, statSync as statSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync7, statSync as statSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import os3 from "node:os";
-import path9 from "node:path";
+import path10 from "node:path";
 var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
-  let dir = path9.resolve(cwd);
+  let dir = path10.resolve(cwd);
   while (true) {
-    if (existsSync5(path9.join(dir, "packages", "workit-core", "package.json")))
+    if (existsSync6(path10.join(dir, "packages", "workit-core", "package.json")))
       return dir;
-    const parent = path9.dirname(dir);
+    const parent = path10.dirname(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -21947,8 +21966,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, resolve = (options) => {
   const env = options.env ?? process.env;
   const home = options.home ?? env.HOME ?? os3.homedir();
-  const configDir2 = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path9.join(home, ".config", "workit");
-  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path9.join(home, ".local", "state", "workit");
+  const configDir2 = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path10.join(home, ".config", "workit");
+  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path10.join(home, ".local", "state", "workit");
   const cwd = options.cwd ?? process.cwd();
   const dev = options.dev ?? env.WORKFLOW_TOOLKIT_DEV ?? findDevFromCwd(cwd);
   return {
@@ -21958,10 +21977,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     stateDir,
     cwd,
     dev,
-    opencodeConfig: options.opencodeConfig ?? path9.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path9.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path9.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path9.join(home, ".cursor", "plugins", "local", "workit"),
+    opencodeConfig: options.opencodeConfig ?? path10.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path10.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path10.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path10.join(home, ".cursor", "plugins", "local", "workit"),
     env,
     installer: options.installer ?? false
   };
@@ -21983,13 +22002,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const list = Array.isArray(plugin) ? plugin : typeof plugin === "string" ? [plugin] : [];
   return list.map(String).filter(isWorkitPlugin);
 }, commandOnPath2 = (name, env) => {
-  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path9.delimiter);
+  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path10.delimiter);
   const names = process.platform === "win32" ? [name, `${name}.exe`] : [name];
   for (const dir of dirs) {
     if (!dir)
       continue;
     for (const candidateName of names) {
-      const candidate = path9.join(dir, candidateName);
+      const candidate = path10.join(dir, candidateName);
       try {
         const st = statSync3(candidate);
         if (process.platform !== "win32" && (st.mode & 73) === 0)
@@ -22015,14 +22034,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return true;
 }, resolveBun = (env) => {
-  if (env.BUN && existsSync5(env.BUN))
+  if (env.BUN && existsSync6(env.BUN))
     return env.BUN;
   for (const candidate of [
-    path9.join(os3.homedir(), ".bun/bin/bun"),
+    path10.join(os3.homedir(), ".bun/bin/bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ]) {
-    if (existsSync5(candidate))
+    if (existsSync6(candidate))
       return candidate;
   }
   return commandOnPath2("bun", env) ? "bun" : null;
@@ -22070,7 +22089,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping version parity"
     };
   }
-  const corePkg = readJson(path9.join(res.dev, "packages/workit-core/package.json"));
+  const corePkg = readJson(path10.join(res.dev, "packages/workit-core/package.json"));
   if (!corePkg) {
     return {
       id: "versions",
@@ -22080,7 +22099,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   const refs = new Set;
   for (const name of ["workit-opencode", "workit-cursor", "workit-cli"]) {
-    const pkg = readJson(path9.join(res.dev, "packages", name, "package.json"));
+    const pkg = readJson(path10.join(res.dev, "packages", name, "package.json"));
     const dep = pkg?.dependencies?.["@brainervirus/workit-core"];
     if (typeof dep === "string")
       refs.add(dep);
@@ -22096,7 +22115,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (refs.size > 1) {
     problems.push(`adapters pin different core versions: ${[...refs].join(", ")}`);
   }
-  const opencodePkg = readJson(path9.join(res.dev, "packages/workit-opencode/package.json"));
+  const opencodePkg = readJson(path10.join(res.dev, "packages/workit-opencode/package.json"));
   const sdk = opencodePkg?.dependencies?.["@opencode-ai/plugin"];
   const sdkVersion = typeof sdk === "string" ? (sdk.match(/^\d+(?:\.\d+){0,2}/) ?? [])[0] : null;
   if (sdkVersion && !semverAtLeast(sdkVersion, SUPPORT_MATRIX.opencode.minimum)) {
@@ -22116,27 +22135,27 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: "Align every adapter to the same @brainervirus/workit-core version (rewrite-workspace-deps.ts) or reinstall"
   };
 }, assetPathsFor = (host, dev) => {
-  const pkg = path9.join(dev, "packages", `workit-${host}`);
+  const pkg = path10.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode":
       return [
-        path9.join(pkg, "assets", "commands", "wk-init.md"),
-        path9.join(pkg, "assets", "skills", "wk-init", "SKILL.md"),
-        path9.join(pkg, "assets", "templates", "spec-template.md"),
-        path9.join(pkg, "assets", "vendor", "superpowers", "skills", "brainstorming", "SKILL.md")
+        path10.join(pkg, "assets", "commands", "wk-init.md"),
+        path10.join(pkg, "assets", "skills", "wk-init", "SKILL.md"),
+        path10.join(pkg, "assets", "templates", "spec-template.md"),
+        path10.join(pkg, "assets", "vendor", "superpowers", "skills", "brainstorming", "SKILL.md")
       ];
     case "cursor":
       return [
-        path9.join(pkg, "assets", "templates", "spec-template.md"),
-        path9.join(pkg, "mcp.json"),
-        path9.join(pkg, ".cursor-plugin")
+        path10.join(pkg, "assets", "templates", "spec-template.md"),
+        path10.join(pkg, "mcp.json"),
+        path10.join(pkg, ".cursor-plugin")
       ];
     case "cli":
-      return [path9.join(pkg, "assets", "templates", "spec-template.md")];
+      return [path10.join(pkg, "assets", "templates", "spec-template.md")];
   }
 }, hostsFor = (host) => host === "cli" ? ["opencode", "cursor", "cli"] : [host], checkAssets = (res) => {
   const dev = res.dev;
-  const missing = dev ? hostsFor(res.host).flatMap((h) => assetPathsFor(h, dev).filter((p) => !existsSync5(p)).map((p) => `${h}: ${p}`)) : [];
+  const missing = dev ? hostsFor(res.host).flatMap((h) => assetPathsFor(h, dev).filter((p) => !existsSync6(p)).map((p) => `${h}: ${p}`)) : [];
   if (res.host === "cursor" || res.host === "cli") {
     const cursorError = validateCursorSkills(res.cursorPluginDir);
     if (cursorError)
@@ -22163,17 +22182,17 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: "Reinstall or rebuild the workit package (missing assets under packages/workit-<host>)"
   };
 }, launcherSlotsFor = (host, dev) => {
-  const pkg = path9.join(dev, "packages", `workit-${host}`);
+  const pkg = path10.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode":
-      return [[path9.join(pkg, "src", "plugin.ts"), path9.join(pkg, "dist", "plugin.js")]];
+      return [[path10.join(pkg, "src", "plugin.ts"), path10.join(pkg, "dist", "plugin.js")]];
     case "cursor":
       return [
-        [path9.join(pkg, "dist", "mcp-server.js")],
-        [path9.join(pkg, "dist", "cursor-session-start.js")]
+        [path10.join(pkg, "dist", "mcp-server.js")],
+        [path10.join(pkg, "dist", "cursor-session-start.js")]
       ];
     case "cli":
-      return [[path9.join(pkg, "src", "index.tsx"), path9.join(pkg, "dist", "index.js")]];
+      return [[path10.join(pkg, "src", "index.tsx"), path10.join(pkg, "dist", "index.js")]];
   }
 }, validNodeEntry = (entry, runtime, env) => {
   try {
@@ -22187,7 +22206,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return false;
   }
 }, registeredCursorLauncher = (res) => {
-  if (!existsSync5(res.cursorMcp))
+  if (!existsSync6(res.cursorMcp))
     return "invalid";
   const config2 = readJson(res.cursorMcp);
   if (!config2)
@@ -22200,7 +22219,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (typeof command !== "string" || !Array.isArray(args) || typeof args[0] !== "string") {
     return "invalid";
   }
-  const executable = path9.basename(command).toLowerCase();
+  const executable = path10.basename(command).toLowerCase();
   const canonical = cursorMcpServerEntry("").args;
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
     if (args.length !== canonical.length || args.some((a, i) => a !== canonical[i]))
@@ -22212,11 +22231,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return {
     kind: "node",
     runtime: command,
-    entry: path9.isAbsolute(args[0]) ? args[0] : path9.resolve(path9.dirname(res.cursorMcp), args[0])
+    entry: path10.isAbsolute(args[0]) ? args[0] : path10.resolve(path10.dirname(res.cursorMcp), args[0])
   };
 }, canonicalCursorHook, registeredCursorHook = (res) => {
-  const hooksFile = path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
-  if (!existsSync5(hooksFile))
+  const hooksFile = path10.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  if (!existsSync6(hooksFile))
     return "invalid";
   const config2 = readJson(hooksFile);
   if (!config2)
@@ -22233,9 +22252,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!m)
     return false;
   const entry = m[1].trim();
-  if (!path9.isAbsolute(entry))
+  if (!path10.isAbsolute(entry))
     return false;
-  if (path9.resolve(entry) !== path9.resolve(path9.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
+  if (path10.resolve(entry) !== path10.resolve(path10.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
     return false;
   }
   return validNodeEntry(entry, "node", res.env);
@@ -22244,7 +22263,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const hosts = hostsFor(res.host);
   const registered = hosts.includes("cursor") ? registeredCursorLauncher(res) : null;
   const runtime = registered && registered !== "invalid" && registered.kind === "node" ? registered.runtime : "node";
-  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path9.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
+  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path10.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
   if (hosts.includes("cursor")) {
     if (registered === "invalid") {
       missing.push(`cursor: canonical workit MCP launcher in ${res.cursorMcp}`);
@@ -22253,13 +22272,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     }
     const hook = registeredCursorHook(res);
     if (hook === "invalid") {
-      missing.push(`cursor: canonical session-start hook in ${path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
+      missing.push(`cursor: canonical session-start hook in ${path10.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
     } else if (hook !== null && hook !== canonicalCursorHook && !validLocalDistHook(hook, res)) {
-      missing.push(`cursor: canonical session-start hook in ${path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
+      missing.push(`cursor: canonical session-start hook in ${path10.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
     }
   }
   if (dev) {
-    missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync5(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
+    missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync6(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
   }
   if (missing.length > 0) {
     return {
@@ -22276,7 +22295,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping non-Cursor launcher checks"
     };
   }
-  return { id: "launcher", status: "pass", detail: `${res.host} launcher/hook entries present` };
+  return {
+    id: "launcher",
+    status: "pass",
+    detail: `${res.host} launcher/hook entries present`
+  };
 }, checkUtility = (res) => {
   const git = commandOnPath2("git", res.env);
   if (!git) {
@@ -22295,7 +22318,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Install util-linux (flock)"
     };
   }
-  return { id: "utility", status: "pass", detail: "git (and flock where required) on PATH" };
+  return {
+    id: "utility",
+    status: "pass",
+    detail: "git (and flock where required) on PATH"
+  };
 }, staleEntry = (entry) => {
   if (!entry)
     return "stale";
@@ -22303,7 +22330,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return "stale";
   if (entry.startsWith("file:")) {
     const target = entry.replace(/^file:\/\//, "").replace(/^file:/, "");
-    return existsSync5(target) ? "ok" : "missing-file";
+    return existsSync6(target) ? "ok" : "missing-file";
   }
   return "ok";
 }, checkStalePin = (res) => {
@@ -22314,8 +22341,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "opencode pin not inspected on the cursor host"
     };
   }
-  if (!existsSync5(res.opencodeConfig)) {
-    return { id: "stale_pin", status: "pass", detail: "no opencode config — not registered" };
+  if (!existsSync6(res.opencodeConfig)) {
+    return {
+      id: "stale_pin",
+      status: "pass",
+      detail: "no opencode config — not registered"
+    };
   }
   const cfg = readJson(res.opencodeConfig);
   const entries = pluginEntries(cfg);
@@ -22345,17 +22376,125 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     };
   }
   return { id: "stale_pin", status: "pass", detail: "opencode pin resolves" };
+}, pluginMcpSelectors = (res) => {
+  const p = path10.join(res.cursorPluginDir, "mcp.json");
+  if (!existsSync6(p))
+    return null;
+  const cfg = readJson(p);
+  const server = cfg?.mcpServers?.workit;
+  if (!server || typeof server !== "object" || Array.isArray(server))
+    return null;
+  const args = server.args;
+  if (!Array.isArray(args))
+    return null;
+  return args.map(String).filter((a) => a.startsWith("--package="));
+}, registryLatestVersion = (res) => {
+  const seam = res.env.WORKIT_DOCTOR_STALE_REGISTRY_VERSION;
+  if (typeof seam === "string" && seam) {
+    return /^\d+(?:\.\d+){1,2}$/.test(seam) ? seam : null;
+  }
+  const cmd = res.env.WORKIT_DOCTOR_STALE_REGISTRY_CMD ?? (commandOnPath2("npm", res.env) ? "npm" : null);
+  if (!cmd)
+    return null;
+  try {
+    const r = spawnSync4(cmd, ["view", CURSOR_RUNTIME_PACKAGE, "version"], {
+      encoding: "utf8",
+      timeout: 20000,
+      env: res.env
+    });
+    const v = (r.stdout ?? "").trim().split(/\s+/)[0];
+    return r.status === 0 && /^\d+(?:\.\d+){1,2}$/.test(v) ? v : null;
+  } catch {
+    return null;
+  }
+}, installedPluginVersion = (res) => {
+  const pkg = readJson(path10.join(res.cursorPluginDir, "package.json"));
+  return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
+}, checkStaleInstall = (res) => {
+  if (res.host !== "cursor" && res.host !== "cli") {
+    return {
+      id: "stale_install",
+      status: "pass",
+      detail: "cursor plugin not inspected on the opencode host"
+    };
+  }
+  const canonicalMcp = cursorMcpServerEntry("").args.find((a) => a.startsWith("--package="));
+  const mcpSelectors = pluginMcpSelectors(res);
+  const legacyPin = (mcpSelectors ?? []).find((s) => s !== canonicalMcp && s.includes("@brainervirus/workit-cursor@"));
+  if (legacyPin) {
+    return {
+      id: "stale_install",
+      status: "fail",
+      detail: `stale_install: plugin mcp.json pins a legacy selector ${legacyPin} (canonical: ${canonicalMcp})`,
+      fix: "Re-run install-cursor-plugin.sh — it rewrites the workit MCP entry to the canonical @latest selector"
+    };
+  }
+  const hooksFile = path10.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hookCmd = readJson(hooksFile)?.hooks?.sessionStart?.[0]?.command ?? null;
+  const canonicalHook = canonicalCursorHook;
+  const staleHook = hookCmd !== null && hookCmd !== canonicalHook && !hookCmd.startsWith("node ") && hookCmd.includes("@brainervirus/workit-cursor@");
+  if (staleHook) {
+    return {
+      id: "stale_install",
+      status: "fail",
+      detail: `stale_install: sessionStart hook runs a legacy selector (canonical: ${canonicalHook})`,
+      fix: "Re-run install-cursor-plugin.sh — it rewrites the sessionStart hook to the canonical @latest selector"
+    };
+  }
+  const installed = installedPluginVersion(res);
+  const source = res.dev ? readJson(path10.join(res.dev, "packages/workit-cursor/package.json"))?.version ?? null : readJson(path10.join(packageRoot(), "package.json"))?.version ?? null;
+  const localDist = mcpSelectors === null && hookCmd !== null && hookCmd.startsWith("node ");
+  if (localDist && installed !== null && source !== null && !semverAtLeast(installed, source)) {
+    return {
+      id: "stale_install",
+      status: "fail",
+      detail: `stale_install: installed workit-cursor ${installed} is behind the current runtime ${source}`,
+      fix: "Re-run install-cursor-plugin.sh — it refreshes the plugin directory and rewrites the workit MCP/hook entries"
+    };
+  }
+  if (installed !== null && localDist) {
+    const expected = registryLatestVersion(res);
+    if (expected === null) {
+      return {
+        id: "registry_unreachable",
+        status: "warn",
+        registryProbed: true,
+        detail: "registry_unreachable: cannot compare installed workit-cursor against the published runtime",
+        fix: "Retry when the npm registry is reachable, or re-run install-cursor-plugin.sh to refresh the install"
+      };
+    }
+    if (!semverAtLeast(installed, expected)) {
+      return {
+        id: "stale_install",
+        status: "fail",
+        registryProbed: true,
+        detail: `stale_install: local-dist workit-cursor ${installed} is behind the published runtime ${expected}`,
+        fix: "Re-run install-cursor-plugin.sh — it refreshes the plugin directory with the current build"
+      };
+    }
+    return {
+      id: "stale_install",
+      status: "pass",
+      registryProbed: true,
+      detail: `installed local-dist workit-cursor ${installed} matches the published runtime ${expected}`
+    };
+  }
+  return {
+    id: "stale_install",
+    status: "pass",
+    detail: installed === null ? "installed workit-cursor selectors are canonical" : `installed workit-cursor ${installed} is metadata on the canonical @latest install (fresh at launch)`
+  };
 }, checkDuplicateRegistration = (res) => {
   const problems = [];
   const opencodeHost = res.host !== "cursor";
   const cursorHost = res.host !== "opencode";
-  if (opencodeHost && existsSync5(res.opencodeConfig)) {
+  if (opencodeHost && existsSync6(res.opencodeConfig)) {
     const cfg = readJson(res.opencodeConfig);
     const entries = pluginEntries(cfg);
     if (entries.length > 1)
       problems.push(`opencode registers ${entries.length} workit plugin entries`);
   }
-  if (cursorHost && existsSync5(res.cursorSettings)) {
+  if (cursorHost && existsSync6(res.cursorSettings)) {
     const settings = readJson(res.cursorSettings);
     const enabled = settings?.enabled_plugins;
     if (enabled && typeof enabled === "object") {
@@ -22370,7 +22509,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     if (dirs.length > 1)
       problems.push(`cursor plugin_dirs has ${dirs.length} workit entries`);
   }
-  if (cursorHost && existsSync5(res.cursorMcp)) {
+  if (cursorHost && existsSync6(res.cursorMcp)) {
     const mcp = readJson(res.cursorMcp);
     const servers = mcp?.mcpServers ?? {};
     if (servers && typeof servers === "object") {
@@ -22380,7 +22519,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     }
   }
   if (problems.length === 0) {
-    return { id: "duplicate_registration", status: "pass", detail: "no duplicate registrations" };
+    return {
+      id: "duplicate_registration",
+      status: "pass",
+      detail: "no duplicate registrations"
+    };
   }
   return {
     id: "duplicate_registration",
@@ -22391,21 +22534,25 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, checkMalformedConfig = (res) => {
   const files = [];
   for (const name of ["config.json", "youtrack.json", "vcs.json", "workspaces.json"]) {
-    const p = path9.join(res.configDir, name);
-    if (existsSync5(p))
+    const p = path10.join(res.configDir, name);
+    if (existsSync6(p))
       files.push(p);
   }
   const opencodeHost = res.host !== "cursor";
   const cursorHost = res.host !== "opencode";
-  if (opencodeHost && existsSync5(res.opencodeConfig))
+  if (opencodeHost && existsSync6(res.opencodeConfig))
     files.push(res.opencodeConfig);
-  if (cursorHost && existsSync5(res.cursorSettings))
+  if (cursorHost && existsSync6(res.cursorSettings))
     files.push(res.cursorSettings);
-  if (cursorHost && existsSync5(res.cursorMcp))
+  if (cursorHost && existsSync6(res.cursorMcp))
     files.push(res.cursorMcp);
   const bad = files.filter((p) => !parsesAsConfigObject(p));
   if (bad.length === 0)
-    return { id: "malformed_config", status: "pass", detail: "config files parse" };
+    return {
+      id: "malformed_config",
+      status: "pass",
+      detail: "config files parse"
+    };
   return {
     id: "malformed_config",
     status: "fail",
@@ -22413,12 +22560,20 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: `Repair the malformed config in ${bad[0]}`
   };
 }, checkWorkspaceMismatch = (res) => {
-  const file = path9.join(res.configDir, "workspaces.json");
-  if (!existsSync5(file))
-    return { id: "workspace_mismatch", status: "pass", detail: "no workspaces configured" };
+  const file = path10.join(res.configDir, "workspaces.json");
+  if (!existsSync6(file))
+    return {
+      id: "workspace_mismatch",
+      status: "pass",
+      detail: "no workspaces configured"
+    };
   const ws = readJson(file);
   if (!Array.isArray(ws?.workspaces)) {
-    return { id: "workspace_mismatch", status: "pass", detail: "no workspaces configured" };
+    return {
+      id: "workspace_mismatch",
+      status: "pass",
+      detail: "no workspaces configured"
+    };
   }
   const match = resolveWorkspaceFrom(res.cwd, res.configDir);
   if (match)
@@ -22441,29 +22596,33 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
 }, checkCredentialMetadata = (res) => {
   const tokenPaths = [];
-  const youtrackJson = readJson(path9.join(res.configDir, "youtrack.json"));
+  const youtrackJson = readJson(path10.join(res.configDir, "youtrack.json"));
   if (youtrackJson) {
-    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path9.join(res.configDir, "youtrack.token"));
-  } else if (existsSync5(path9.join(res.configDir, "youtrack.token"))) {
-    tokenPaths.push(path9.join(res.configDir, "youtrack.token"));
+    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path10.join(res.configDir, "youtrack.token"));
+  } else if (existsSync6(path10.join(res.configDir, "youtrack.token"))) {
+    tokenPaths.push(path10.join(res.configDir, "youtrack.token"));
   }
-  const vcsJson = readJson(path9.join(res.configDir, "vcs.json"));
+  const vcsJson = readJson(path10.join(res.configDir, "vcs.json"));
   for (const key of ["gitlab", "github"]) {
     const provider = vcsJson?.[key];
     if (provider && typeof provider === "object") {
       const tf = provider.tokenFile;
-      tokenPaths.push(typeof tf === "string" ? tf : path9.join(res.configDir, `${key}.token`));
-    } else if (!vcsJson && existsSync5(path9.join(res.configDir, `${key}.token`))) {
-      tokenPaths.push(path9.join(res.configDir, `${key}.token`));
+      tokenPaths.push(typeof tf === "string" ? tf : path10.join(res.configDir, `${key}.token`));
+    } else if (!vcsJson && existsSync6(path10.join(res.configDir, `${key}.token`))) {
+      tokenPaths.push(path10.join(res.configDir, `${key}.token`));
     }
   }
   if (tokenPaths.length === 0) {
-    return { id: "credential_metadata", status: "pass", detail: "no credentials configured" };
+    return {
+      id: "credential_metadata",
+      status: "pass",
+      detail: "no credentials configured"
+    };
   }
   const problems = [];
   for (const raw of tokenPaths) {
-    const p = path9.isAbsolute(raw) ? raw : path9.resolve(res.configDir, raw);
-    if (!existsSync5(p)) {
+    const p = path10.isAbsolute(raw) ? raw : path10.resolve(res.configDir, raw);
+    if (!existsSync6(p)) {
       problems.push(`${p} is missing`);
       continue;
     }
@@ -22489,13 +22648,17 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: "Create or fix the token file (mode 0600, real value) — see /wk-status for the exact path"
   };
 }, checkLogWritable = (res) => {
-  const logsDir = path9.join(res.stateDir, "logs");
-  const probe = path9.join(logsDir, "doctor-probe.tmp");
+  const logsDir = path10.join(res.stateDir, "logs");
+  const probe = path10.join(logsDir, "doctor-probe.tmp");
   try {
     mkdirSync4(logsDir, { recursive: true, mode: 448 });
     writeFileSync3(probe, `{"probe":true}
 `, { mode: 384 });
-    return { id: "log_writable", status: "pass", detail: "log directory writable" };
+    return {
+      id: "log_writable",
+      status: "pass",
+      detail: "log directory writable"
+    };
   } catch (err) {
     return {
       id: "log_writable",
@@ -22511,15 +22674,20 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, RUN_CHECKS, INSTALLER_REQUIRED, runDoctor = (options = {}) => {
   const res = resolve(options);
   const raw = RUN_CHECKS.map((fn) => fn(res));
-  const checks4 = res.installer ? raw.map((c) => c.status === "fail" && !INSTALLER_REQUIRED.has(c.id) ? { ...c, status: "warn", detail: `${c.detail} (not enforced by installer)` } : c) : raw;
+  const checks4 = res.installer ? raw.map((c) => c.status === "fail" && !INSTALLER_REQUIRED.has(c.id) ? {
+    ...c,
+    status: "warn",
+    detail: `${c.detail} (not enforced by installer)`
+  } : c) : raw;
   const failed = checks4.filter((c) => c.status === "fail").length;
   const warned = checks4.filter((c) => c.status === "warn").length;
   const passed = checks4.filter((c) => c.status === "pass").length;
   const exitCode = failed > 0 ? 1 : 0;
+  const offline = !raw.some((c) => ("registryProbed" in c) && c.registryProbed);
   const report = {
     ok: failed === 0,
     exitCode,
-    offline: true,
+    offline,
     host: res.host,
     checked_at: new Date().toISOString(),
     summary: { passed, warned, failed, total: checks4.length },
@@ -22529,7 +22697,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   getDiagnosticLogger()?.info(EVENT.doctor, {
     host: res.host,
     exit_code: exitCode,
-    offline: true,
+    offline,
     failed: checks4.filter((c) => c.status === "fail").map((c) => c.id),
     total: checks4.length
   });
@@ -22539,6 +22707,7 @@ var init_doctor = __esm(() => {
   init_support_matrix();
   init_boundary();
   init_config();
+  init_package_root();
   init_registration();
   init_workspaces();
   init_skill_manifests();
@@ -22550,6 +22719,7 @@ var init_doctor = __esm(() => {
     checkLauncher,
     checkUtility,
     checkStalePin,
+    checkStaleInstall,
     checkDuplicateRegistration,
     checkMalformedConfig,
     checkWorkspaceMismatch,
@@ -22562,6 +22732,7 @@ var init_doctor = __esm(() => {
     "launcher",
     "utility",
     "stale_pin",
+    "stale_install",
     "duplicate_registration",
     "malformed_config"
   ]);
@@ -22569,7 +22740,7 @@ var init_doctor = __esm(() => {
 
 // packages/workit-core/src/core/pr-create.ts
 import fs2 from "node:fs";
-import path10 from "node:path";
+import path11 from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function parseGhRepo(remote) {
   remote = (remote || "").trim().replace(/\/+$/, "");
@@ -22634,11 +22805,11 @@ ${line}` : line;
 }
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path10.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path11.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path10.join(dir, name);
+      const candidate = path11.join(dir, name);
       try {
         fs2.accessSync(candidate, fs2.constants.X_OK);
         return candidate;
@@ -22740,7 +22911,7 @@ function prCreate(env, cwd) {
   const draft = String(env.WF_PR_DRAFT ?? "false").toLowerCase() === "true";
   let baseUrl = cfg.youtrack_base_url;
   if (!baseUrl) {
-    const ytCfg = process.env.WORKFLOW_YOUTRACK_CONFIG ?? path10.join(path10.dirname(String(cfg.configPath)), "youtrack.json");
+    const ytCfg = process.env.WORKFLOW_YOUTRACK_CONFIG ?? path11.join(path11.dirname(String(cfg.configPath)), "youtrack.json");
     try {
       const yt = JSON.parse(fs2.readFileSync(ytCfg, "utf8"));
       if (yt && typeof yt === "object")
@@ -22849,25 +23020,6 @@ var init_pr_create = __esm(() => {
   init_branch();
 });
 
-// packages/workit-core/src/core/package-root.ts
-import { existsSync as existsSync6 } from "node:fs";
-import path11 from "node:path";
-import { fileURLToPath } from "node:url";
-var packageRoot = () => {
-  let dir = path11.dirname(fileURLToPath(import.meta.url));
-  while (true) {
-    const parent = path11.dirname(dir);
-    if (existsSync6(path11.join(dir, "package.json")) || parent === dir)
-      return dir;
-    dir = parent;
-  }
-}, assetRoot = () => {
-  const root = packageRoot();
-  const assets = path11.join(root, "assets");
-  return existsSync6(assets) ? assets : root;
-};
-var init_package_root = () => {};
-
 // packages/workit-core/src/core/scripts.ts
 var PLUGIN_ROOT, ASSET_ROOT, resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 var init_scripts = __esm(() => {
@@ -24114,6 +24266,58 @@ function sddAppendProgress({
   const rel = posix2(path19.relative(contained.base, path_));
   return { ok: true, line: trimmed, progress_path: rel };
 }
+function sddAppendAdvisory({
+  advisories_path,
+  task_id,
+  text,
+  workspace_root
+}) {
+  if (typeof task_id !== "number" || !Number.isSafeInteger(task_id) || task_id <= 0) {
+    return { error: "task_id must be a positive safe integer", code: "advisory_task_invalid" };
+  }
+  if (typeof text !== "string") {
+    return {
+      error: "advisory text must be a string of 1-1000 characters after normalization",
+      code: "advisory_text_invalid"
+    };
+  }
+  if (text.includes("\r") || text.includes(`
+`)) {
+    return {
+      error: "advisory text must be a single line (no CR/LF)",
+      code: "advisory_text_invalid"
+    };
+  }
+  const collapsed = text.trim().replace(/[ \t]+/g, " ");
+  if (collapsed.length === 0 || collapsed.length > 1000) {
+    return {
+      error: "advisory text must be 1-1000 characters after trim and horizontal-space collapse",
+      code: "advisory_text_invalid"
+    };
+  }
+  if (!/^docs\/[^/]+\/sdd\/advisories\.md$/.test(advisories_path)) {
+    return {
+      error: `advisories_path must be docs/<slug>/sdd/advisories.md: ${advisories_path}`,
+      code: "advisory_path_invalid"
+    };
+  }
+  const contained = resolveDocsPath({ workspace_root, path: advisories_path });
+  if (!contained.ok)
+    return { error: contained.error, code: "advisory_path_invalid" };
+  const abs = contained.path;
+  if (existsSync11(abs) && statSync6(abs).isDirectory()) {
+    return {
+      error: `advisory target is a directory: ${advisories_path}`,
+      code: "advisory_target_invalid"
+    };
+  }
+  mkdirSync6(path19.dirname(abs), { recursive: true });
+  const line = `- Task ${task_id}: ${collapsed}
+`;
+  appendFileSync2(abs, line, "utf8");
+  const rel = posix2(path19.relative(contained.base, abs));
+  return { ok: true, advisory: collapsed, advisories_path: rel };
+}
 var posix2 = (p) => p.split(path19.sep).join("/"), PROGRESS_RE;
 var init_sdd = __esm(() => {
   init_docs_validate();
@@ -24134,6 +24338,7 @@ import {
   fsyncSync,
   mkdirSync as mkdirSync7,
   openSync,
+  readdirSync as readdirSync6,
   readFileSync as readFileSync13,
   renameSync,
   rmSync,
@@ -24146,16 +24351,20 @@ import path20 from "node:path";
 
 class HostReceiptStore {
   #bySession = new Map;
-  record(sessionId, callID, selectedLabel, recordedAt = Date.now(), question) {
-    const label = selectedLabel.trim();
-    if (!label)
+  record(sessionId, callID, selectedLabel, recordedAt = Date.now(), question = "", purpose) {
+    const trimmed = selectedLabel.trim();
+    if (!trimmed)
       return;
     if (recordedAt > Date.now() + MAX_CLOCK_SKEW_MS)
       return;
+    const derived = purpose ?? receiptPurposeForLabel(selectedLabel);
+    if (derived === undefined)
+      return;
+    const q = question ?? "";
     const queue = this.#bySession.get(sessionId) ?? [];
     if (queue.length >= MAX_RECEIPTS_PER_SESSION)
       queue.shift();
-    queue.push({ sessionId, callID, selectedLabel: label, recordedAt, question });
+    queue.push({ sessionId, callID, selectedLabel, recordedAt, question: q, purpose: derived });
     this.#bySession.set(sessionId, queue);
   }
   count(sessionId) {
@@ -24172,10 +24381,40 @@ class HostReceiptStore {
     if (!queue || queue.length === 0) {
       return err2("receipt_missing", "no host-observed native-question receipt for this session — ask the native " + "`question` tool and have the user answer before calling this tool");
     }
-    const index = queue.length - 1;
+    let index = -1;
+    if (opts.purpose !== undefined) {
+      const top = queue[queue.length - 1];
+      if (top && top.purpose === opts.purpose && isNegativeLabel(top.selectedLabel)) {
+        const filtered = queue.filter((r) => r.purpose !== opts.purpose);
+        if (filtered.length === 0)
+          this.#bySession.delete(sessionId);
+        else
+          this.#bySession.set(sessionId, filtered);
+        return err2("receipt_rejected", `the user's most recent answer (${JSON.stringify(top.selectedLabel)}) is a ` + "negative answer — it cannot authorize an approval; ask the native question again");
+      }
+      for (let i = queue.length - 1;i >= 0; i--) {
+        if (queue[i].purpose === opts.purpose) {
+          index = i;
+          break;
+        }
+      }
+      if (index === -1) {
+        return err2("receipt_missing", `no host-observed receipt for purpose ${JSON.stringify(opts.purpose)} — ask the native question for that purpose`);
+      }
+    } else {
+      index = queue.length - 1;
+    }
     const receipt = queue[index];
     if (isNegativeLabel(receipt.selectedLabel)) {
-      this.#bySession.delete(sessionId);
+      if (opts.purpose !== undefined) {
+        const filtered = queue.filter((r) => r.purpose !== opts.purpose);
+        if (filtered.length === 0)
+          this.#bySession.delete(sessionId);
+        else
+          this.#bySession.set(sessionId, filtered);
+      } else {
+        this.#bySession.delete(sessionId);
+      }
       return err2("receipt_rejected", `the user's most recent answer (${JSON.stringify(receipt.selectedLabel)}) is a ` + "negative answer — it cannot authorize an approval; ask the native question again");
     }
     if (opts.label !== undefined && !sameChoiceLabel(receipt.selectedLabel, opts.label)) {
@@ -24244,7 +24483,8 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     execution: {
       status: execution.status ?? "pending",
       mode: execution.mode ?? null,
-      evidence: execution.evidence ?? null
+      evidence: execution.evidence ?? null,
+      coordinator_session_id: execution.coordinator_session_id ?? null
     },
     handoff_destination: p.handoff_destination ?? false,
     updated_at: p.updated_at ?? Date.now()
@@ -24255,7 +24495,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   spec: { path: "", status: "draft", evidence: null, approved_digest: null },
   plan: { path: "", status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null },
+  execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
   handoff_destination: false,
   updated_at: Date.now()
 }), readFlowState = (root, slug) => {
@@ -24364,6 +24604,12 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   if (execRaw?.evidence !== undefined && !validateEvidenceValue(execRaw.evidence, true)) {
     return { ok: false, error: "flow state execution.evidence has an unsupported shape" };
   }
+  if (execRaw?.coordinator_session_id !== undefined && execRaw.coordinator_session_id !== null && typeof execRaw.coordinator_session_id !== "string") {
+    return {
+      ok: false,
+      error: "flow state execution.coordinator_session_id must be a string or null"
+    };
+  }
   return {
     ok: true,
     state: {
@@ -24379,7 +24625,8 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
       execution: {
         status: execRaw?.status ?? "pending",
         mode: execRaw?.mode ?? null,
-        evidence: execRaw?.evidence ?? null
+        evidence: execRaw?.evidence ?? null,
+        coordinator_session_id: execRaw?.coordinator_session_id ?? null
       },
       handoff_destination: parsed.handoff_destination ?? false,
       updated_at: parsed.updated_at ?? Date.now()
@@ -24506,7 +24753,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   spec: { ...state.spec, status: "draft", evidence: null, approved_digest: null },
   plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null },
+  execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
   handoff_destination: false,
   updated_at: Date.now()
 }), resetForPlanDrift = (state) => ({
@@ -24545,9 +24792,14 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
 }, deriveLegacyExecution = (root, slug, state) => {
   const ledger = ledgerCompletion(root, slug);
   if (state.plan.status === "approved" && state.menu.chosen === "subagent-driven" && ledger.started && !ledger.complete) {
-    return { status: "active", mode: "subagent-driven", evidence: null };
+    return {
+      status: "active",
+      mode: "subagent-driven",
+      evidence: null,
+      coordinator_session_id: null
+    };
   }
-  return { status: "pending", mode: null, evidence: null };
+  return { status: "pending", mode: null, evidence: null, coordinator_session_id: null };
 }, normalizeCompatibility = (root, slug, parsed, state) => {
   if (!isRecord(parsed) || !("execution" in parsed)) {
     const derived = deriveLegacyExecution(root, slug, state);
@@ -24555,6 +24807,11 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     if (derived.status !== current.status || derived.mode !== current.mode) {
       return { state: { ...state, execution: derived, updated_at: Date.now() }, changed: true };
     }
+    return { state, changed: false };
+  }
+  const execRaw = isRecord(parsed.execution) ? parsed.execution : undefined;
+  if (execRaw && !("coordinator_session_id" in execRaw)) {
+    return { state: { ...state, updated_at: Date.now() }, changed: true };
   }
   return { state, changed: false };
 }, withFlowLock = (file, fn) => {
@@ -24684,14 +24941,6 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     return err2("workspace_mismatch", `mutation context workspace ${JSON.stringify(ctx.hostWorkspace)} does not match flow workspace ${JSON.stringify(root)}`);
   }
   return { ok: true };
-}, assertCoordinatorBoundary = (ctx, state) => {
-  if (ctx?.role === "coordinator" && state.execution.status === "active" && state.execution.mode === "subagent-driven") {
-    return err2("coordinator_blocked", COORDINATOR_RECOVERY_TEXT);
-  }
-  if (ctx?.role === "delegated" && !ctx.taskIdentity) {
-    return err2("delegated_unauthenticated", "delegated mutations require an authenticated task identity (taskIdentity) — re-run inside the delegated worker session");
-  }
-  return { ok: true };
 }, MAX_CLOCK_SKEW_MS = 60000, MAX_RECEIPTS_PER_SESSION = 10, RECEIPT_FRESHNESS_MS, EVIDENCE_WINDOW_MS, NEGATIVE_ANSWER_LABELS, isNegativeLabel = (label) => {
   const normalized = label.trim().toLowerCase();
   return NEGATIVE_ANSWER_LABELS.some((entry) => {
@@ -24702,6 +24951,31 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     }
     return firstWord.replace(/[^a-z]/g, "") === entry;
   });
+}, receiptPurposeForLabel = (label) => {
+  const n = normalizeLabel(label);
+  if (n === "approve spec" || n === "approve spec recommended")
+    return "spec-approval";
+  if (n === "approve plan" || n === "approve plan recommended")
+    return "plan-approval";
+  if (n === "approve")
+    return;
+  if (n === "pause plan")
+    return "plan-pause";
+  if (n === "resume plan")
+    return "plan-resume";
+  if (n === "complete plan")
+    return "plan-complete";
+  const exec = new Set([
+    "subagent driven",
+    "inline",
+    "handoff",
+    "review spec",
+    "review plan",
+    "change model"
+  ]);
+  if (exec.has(n))
+    return "execution-menu";
+  return;
 }, sameChoiceLabel = (a, b) => normalizeLabel(a) === normalizeLabel(b), normalizeLabel = (s) => s.replace(/\s*\([^)]*\)/g, " ").replace(/\s*\bfirst\b\s*$/i, " ").replace(/[^a-z0-9]+/gi, " ").trim().toLowerCase(), createCursorConfirmation = () => ({
   ok: true,
   evidence: { host: "cursor", attested: false, confirmation: "contract" }
@@ -24806,7 +25080,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
         spec: { path: specPath, status: "draft", evidence: null, approved_digest: null },
         plan: { path: planPath, status: "draft", evidence: null, approved_digest: null },
         menu: { presented: false, chosen: "", evidence: null },
-        execution: { status: "pending", mode: null, evidence: null },
+        execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
         handoff_destination: false,
         updated_at: Date.now()
       });
@@ -24949,13 +25223,24 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
       return err2("recursive_handoff", "this flow is already a handoff destination — a second handoff is rejected");
     }
     const executing = choice === "subagent-driven" || choice === "inline";
+    const coordinatorSessionId = choice === "subagent-driven" && recorded.evidence.host === "opencode" ? ctx?.sessionId ?? null : null;
     return {
       ok: true,
       next: {
         ...state,
         plan: { ...state.plan, path: state.plan.path || `docs/${slug}/plan.md` },
         menu: { presented: true, chosen: choice, evidence: recorded.evidence },
-        execution: executing ? { status: "active", mode: choice, evidence: recorded.evidence } : { status: "pending", mode: null, evidence: recorded.evidence },
+        execution: executing ? {
+          status: "active",
+          mode: choice,
+          evidence: recorded.evidence,
+          coordinator_session_id: coordinatorSessionId
+        } : {
+          status: "pending",
+          mode: null,
+          evidence: recorded.evidence,
+          coordinator_session_id: null
+        },
         updated_at: Date.now()
       }
     };
@@ -25043,7 +25328,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     }
     const next = {
       ...reconciled.state,
-      execution: { ...exec, status: "completed" },
+      execution: { ...exec, status: "completed", coordinator_session_id: null },
       handoff_destination: false,
       updated_at: Date.now()
     };
@@ -25103,7 +25388,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
 }, slugFromSddPath = (p) => {
   const match = p.split(path20.sep).join("/").match(/^docs\/([^/]+)\/sdd(\/|$|['"])/);
   return match?.[1] ?? "";
-}, assertProductGates = (root, slug, opts = {}, ctx) => {
+}, assertSddControlGates = (root, slug, opts = {}, ctx) => {
   const bound = assertMutationWorkspace(root, ctx);
   if (!bound.ok)
     return bound;
@@ -25129,15 +25414,18 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     if (validated.ok === false)
       return err2("docs_invalid", validated.error);
   }
-  return assertCoordinatorBoundary(ctx, state);
-}, BASH_READ_TOKENS, BASH_GIT_READ_SUBCOMMANDS, BASH_GIT_MUTABLE_SUBCOMMANDS, BASH_GIT_READ_FLAGS, BASH_FIND_DENIED_FLAGS, BASH_TEST_VERBS, BASH_DENIED_HEADS, BASH_OUTPUT_FLAG_VERBS, BASH_PAREN_EXEMPT_HEADS, BASH_GIT_VALUE_FLAGS, COORDINATOR_SHELL_DENIED_TEXT;
+  if (state.execution.status === "active" && state.execution.mode === "subagent-driven" && roleFromParentage(ctx?.parentSessionId, state.execution.coordinator_session_id) === "delegated") {
+    return err2("sdd_control_denied", "SDD control metadata is coordinator-owned while a subagent-driven plan is active — delegated workers cannot mutate task briefs, review packages, progress, or advisories");
+  }
+  return { ok: true };
+}, roleFromParentage = (parentID, coordinatorSessionId) => typeof parentID === "string" && parentID !== "" && parentID === coordinatorSessionId ? "delegated" : "coordinator", BASH_READ_TOKENS, BASH_GIT_READ_SUBCOMMANDS, BASH_GIT_MUTABLE_SUBCOMMANDS, BASH_GIT_READ_FLAGS, BASH_FIND_DENIED_FLAGS, BASH_TEST_VERBS, BASH_DENIED_HEADS, BASH_OUTPUT_FLAG_VERBS, BASH_PAREN_EXEMPT_HEADS, BASH_GIT_VALUE_FLAGS, COORDINATOR_SHELL_DENIED_TEXT;
 var init_flow_state = __esm(() => {
   init_docs_validate();
   init_docs_layout();
   init_sdd();
   init_verify_project();
   init_menu();
-  COORDINATOR_RECOVERY_TEXT = "A subagent-driven plan is active: coordinator product edits are blocked. " + "Delegate product mutations (task briefs, progress, review packages) to an " + "authenticated delegated worker via `task` / `wk-implement` instead of " + "editing in the coordinator session.";
+  COORDINATOR_RECOVERY_TEXT = "A subagent-driven plan is active: coordinator product edits are blocked. " + "Delegate product mutations to an authenticated delegated worker via `task` / `wk-implement` instead of " + "editing in the coordinator session.";
   CURSOR_SUBAGENT_UNSUPPORTED_TEXT = "Cursor cannot execute subagent-driven plans: the MCP has no child-session " + "support. Choose Inline, Handoff, or a review option in this session, or " + "run the plan in OpenCode with `wk-implement`.";
   MENU_CHOICES = [
     "subagent-driven",
@@ -25308,7 +25596,7 @@ import {
   existsSync as existsSync13,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync8,
-  readdirSync as readdirSync6,
+  readdirSync as readdirSync7,
   readFileSync as readFileSync14,
   realpathSync as realpathSync3,
   renameSync as renameSync2,
@@ -25353,7 +25641,7 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
   const root = legacyRoot(workspace_root);
   const raw = [];
   if (existsSync13(root)) {
-    for (const entry of readdirSync6(root, { withFileTypes: true })) {
+    for (const entry of readdirSync7(root, { withFileTypes: true })) {
       const abs = path21.join(root, entry.name);
       const rel = posix3(path21.relative(workspace_root, abs));
       if (entry.isDirectory()) {
@@ -25487,7 +25775,7 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
   if (visits.has(real))
     return { ok: true };
   visits.add(real);
-  for (const entry of readdirSync6(real, { withFileTypes: true })) {
+  for (const entry of readdirSync7(real, { withFileTypes: true })) {
     const fromAbs = path21.join(real, entry.name);
     const fromRel = posix3(path21.join(legacyRel, entry.name));
     const toRel = posix3(path21.join(destRelRoot, entry.name));
@@ -25676,7 +25964,7 @@ var init_docs_migration = __esm(() => {
 });
 
 // packages/workit-core/src/core/docs-repo.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync8, readdirSync as readdirSync7 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync8, readdirSync as readdirSync8 } from "node:fs";
 import { execFileSync as execFileSync6 } from "node:child_process";
 import path22 from "node:path";
 var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(configDir(), "docs-repo.json"), readDocsRepoConfig = () => {
@@ -25716,7 +26004,7 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(conf
   const specs = [];
   const docsDir = path22.join(workspaceRoot, "docs");
   if (existsSync14(docsDir)) {
-    for (const slug of readdirSync7(docsDir)) {
+    for (const slug of readdirSync8(docsDir)) {
       if (slug.startsWith("."))
         continue;
       const spec = path22.posix.join("docs", slug, "spec.md");
@@ -25727,7 +26015,7 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(conf
       if (repoPath) {
         const featuresDir = path22.join(repoPath, "features");
         if (existsSync14(featuresDir)) {
-          const match = readdirSync7(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d));
+          const match = readdirSync8(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d));
           if (match) {
             promoted = true;
             target = path22.join(repoPath, "features", match);
@@ -25814,7 +26102,7 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(conf
   }
   const prefix = monthPrefix();
   const featuresDir = path22.join(repoPath, "features");
-  const existing = existsSync14(featuresDir) ? readdirSync7(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d)) : undefined;
+  const existing = existsSync14(featuresDir) ? readdirSync8(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d)) : undefined;
   const targetDir = path22.join(featuresDir, existing ?? `${prefix}-${slug}`);
   mkdirSync9(targetDir, { recursive: true });
   const files = ["spec.md"];
@@ -25959,7 +26247,7 @@ var init_templates = __esm(() => {
 });
 
 // packages/workit-core/src/core/rules.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync11, readFileSync as readFileSync18, readdirSync as readdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync11, readFileSync as readFileSync18, readdirSync as readdirSync9, writeFileSync as writeFileSync11 } from "node:fs";
 import path25 from "node:path";
 var rulesDir = () => path25.join(configDir(), "rules"), parseRule = (markdown) => {
   const fm = markdown.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
@@ -25989,7 +26277,7 @@ var rulesDir = () => path25.join(configDir(), "rules"), parseRule = (markdown) =
   const result = [];
   const dir = rulesDir();
   if (existsSync17(dir)) {
-    for (const entry of readdirSync8(dir)) {
+    for (const entry of readdirSync9(dir)) {
       const file = path25.join(dir, entry, "rule.md");
       if (!existsSync17(file))
         continue;
@@ -26112,7 +26400,7 @@ import {
   mkdirSync as mkdirSync12,
   mkdtempSync,
   readFileSync as readFileSync19,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   renameSync as renameSync3,
   rmSync as rmSync3,
   statSync as statSync9,
@@ -27742,7 +28030,7 @@ var init_server3 = __esm(async () => {
     const slug = slugFromSddPath(sdd_dir);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertProductGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddTaskBrief({
@@ -27765,7 +28053,7 @@ var init_server3 = __esm(async () => {
     const slug = slugFromSddPath(sdd_dir);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertProductGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddReviewPackage({
@@ -27789,7 +28077,7 @@ var init_server3 = __esm(async () => {
     const slug = slugFromSddPath(progress_path);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertProductGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddAppendProgress({ progress_path, line, workspace_root });
@@ -27797,6 +28085,26 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(withWorkspace(workspace_root, data));
   });
+  registerTool("workflow_sdd_append_advisory", {
+    description: "Append a validated advisory line to docs/<slug>/sdd/advisories.md (coordinator-owned)",
+    inputSchema: {
+      advisories_path: exports_external.string(),
+      task_id: exports_external.number(),
+      text: exports_external.string(),
+      workspace_root: workspaceRootSchema
+    }
+  }, async ({ advisories_path, task_id, text, workspace_root }) => {
+    const slug = slugFromSddPath(advisories_path);
+    if (!slug)
+      return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    if (!gate.ok)
+      return jsonResult({ error: gate.error, code: gate.code });
+    const data = sddAppendAdvisory({ advisories_path, task_id, text, workspace_root });
+    if ("error" in data)
+      return jsonResult({ error: data.error, code: data.code });
+    return jsonResult(withWorkspace(workspace_root, data));
+  });
   registerTool("workflow_docs_branch", {
     description: "Resolve branch for spec/plan authors: keep current feature|bugfix or create from the configured base.",
     inputSchema: {