@brainervirus/workit-cursor 1.0.12 → 1.1.1

package/dist/cursor-session-start.js

@@ -7655,7 +7655,13 @@ var init_task_contract = __esm(() => {
       id
     }).strict(),
     object({ kind: literal("host"), host: hostSchema, handle: nonEmpty }).strict(),
-    object({ kind: literal("external"), url: text.url() }).strict()
+    object({ kind: literal("external"), url: text.url() }).strict(),
+    object({
+      kind: literal("standing"),
+      workspace: nonEmpty,
+      class: nonEmpty,
+      configDigest: nullableDigest
+    }).strict()
   ]);
   provenanceSchema = object({
     kind: _enum(["host_observed", "agent_reported", "imported"]),
@@ -7876,7 +7882,8 @@ var init_task_contract = __esm(() => {
       approvedContent: text,
       displayed: text.optional(),
       contentRefs: array(refSchema),
-      statedChoice: object({ ref: text, text }).strict().optional()
+      statedChoice: object({ ref: text, text }).strict().optional(),
+      standing: object({ workspace: nonEmpty, class: nonEmpty }).strict().optional()
     }).strict(),
     digest,
     response: _enum(["approved", "rejected", "stated"]),
@@ -9794,10 +9801,360 @@ var init_workers = __esm(() => {
   UNCERTAIN_WORKER_STATES = ["dispatching", "running", "cancelling", "unknown"];
 });
 
-// packages/workit-core/src/core/authority.ts
+// packages/workit-core/src/core/boundary.ts
+var EVENT, errorDetail = (err) => {
+  if (err instanceof Error) {
+    return { error_name: err.name, error: err.message };
+  }
+  return { error_name: "unknown", error: String(err) };
+};
+var init_boundary = __esm(() => {
+  EVENT = {
+    initialization: "initialization",
+    provenance: "provenance",
+    assets: "assets",
+    configurationSource: "configuration_source",
+    hooks: "hooks",
+    mcpConnection: "mcp_connection",
+    migration: "migration",
+    installSteps: "install_steps",
+    uncaughtFailure: "uncaught_failure",
+    toolsFailed: "tools_failed",
+    doctor: "doctor"
+  };
+});
+
+// packages/workit-core/src/core/config.ts
+import {
+  copyFileSync,
+  cpSync,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  readdirSync as readdirSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import os from "node:os";
+import path5 from "node:path";
+var diagnosticLogger, PRESETS, resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path5.join(process.env.XDG_CONFIG_HOME || path5.join(os.homedir(), ".config"), "workit"), migratedDir = null, migrationFailed = false, ensureConfigDir = (dir = resolveConfigDir()) => {
+  if (migratedDir === dir)
+    return dir;
+  if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
+    migratedDir = dir;
+    return dir;
+  }
+  const legacy = path5.join(process.env.XDG_CONFIG_HOME || path5.join(os.homedir(), ".config"), "workflow-toolkit");
+  if (!existsSync3(legacy)) {
+    migratedDir = dir;
+    return dir;
+  }
+  if (!migrationFailed && existsSync3(dir)) {
+    migratedDir = dir;
+    return dir;
+  }
+  migrationFailed = false;
+  mkdirSync2(dir, { recursive: true });
+  diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
+  for (const entry of readdirSync2(legacy, { withFileTypes: true })) {
+    const src = path5.join(legacy, entry.name);
+    const dest = path5.join(dir, entry.name);
+    if (existsSync3(dest))
+      continue;
+    try {
+      if (entry.isDirectory())
+        cpSync(src, dest, { recursive: true });
+      else if (entry.isFile())
+        copyFileSync(src, dest);
+    } catch (err) {
+      migrationFailed = true;
+      diagnosticLogger?.warn(EVENT.migration, { from: src, ok: false, ...errorDetail(err) });
+      console.warn(`[workit] config migration: a file could not be copied to ${dir}; it will be retried on the next run`);
+    }
+  }
+  if (!migrationFailed)
+    migratedDir = dir;
+  return dir;
+}, configDir = () => ensureConfigDir(), DEFAULTS, isConfigObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var init_config = __esm(() => {
+  init_boundary();
+  PRESETS = {
+    gitflow: {
+      allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
+      protected: ["main", "develop", "master", "prod", "production"]
+    },
+    "github-flow": { allowed: ["*"], protected: ["main"] },
+    "trunk-based": { allowed: ["*"], protected: ["main"] },
+    custom: { allowed: [], protected: [] }
+  };
+  DEFAULTS = {
+    locale: "en",
+    localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
+    timezone: "America/Santiago",
+    branchPolicy: {
+      preset: "gitflow",
+      allowed: [...PRESETS.gitflow.allowed],
+      protected: [...PRESETS.gitflow.protected]
+    },
+    commitPolicy: { preset: "conventional" }
+  };
+});
+
+// packages/workit-core/src/core/workspaces.ts
+import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
+import path6 from "node:path";
+var readWorkspacesResult = (dir = configDir()) => {
+  const file = path6.join(dir, "workspaces.json");
+  let raw;
+  try {
+    raw = readFileSync3(file, "utf8");
+  } catch {
+    return { status: "missing", path: file, entries: [] };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "malformed", path: file, entries: [], error: `${file} is not valid JSON` };
+  }
+  if (!isConfigObject(parsed)) {
+    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+  }
+  const list = parsed.workspaces;
+  return {
+    status: "valid",
+    path: file,
+    entries: Array.isArray(list) ? list : []
+  };
+}, loadWorkspacesFrom = (dir) => readWorkspacesResult(dir).entries, globToRegExp = (glob) => {
+  let out = "";
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          if (out === "")
+            out += "/?";
+          out += "(?:[^/]+/)*";
+          i += 2;
+        } else {
+          if (i + 2 >= glob.length) {
+            if (out.endsWith("/")) {
+              out = out.slice(0, -1);
+              out += "(?:/.*)?";
+            } else {
+              out += ".*";
+            }
+          } else {
+            out += ".*";
+          }
+          i++;
+        }
+      } else {
+        out += "[^/]*";
+      }
+    } else {
+      out += c.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${out}$`);
+}, matchWorkspace = (glob, target) => globToRegExp(glob.replaceAll("\\", "/")).test(target.replaceAll("\\", "/")), realpathOf = (p) => {
+  const real = realpathSync2.native ?? realpathSync2;
+  try {
+    return real(p);
+  } catch {
+    return p;
+  }
+}, canonicalGlob = (glob) => {
+  const m = /[*?[\]{]/.exec(glob);
+  const prefix = m ? glob.slice(0, m.index) : glob;
+  const rest = m ? glob.slice(m.index) : "";
+  if (!prefix)
+    return glob;
+  const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
+  return real + (prefix.endsWith("/") ? "/" : "") + rest;
+}, resolveWorkspaceFrom = (cwd, dir) => {
+  const targets = [cwd, realpathOf(cwd)].map((p) => p.replaceAll("\\", "/"));
+  for (const entry of loadWorkspacesFrom(dir)) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const ws = entry;
+    if (typeof ws.glob !== "string" || !ws.glob)
+      continue;
+    const glob = ws.glob.replaceAll("\\", "/");
+    const canonical = canonicalGlob(glob);
+    for (const target of targets) {
+      if (matchWorkspace(glob, target))
+        return ws;
+      if (canonical !== glob && matchWorkspace(canonical, target))
+        return ws;
+    }
+  }
+  return null;
+};
+var init_workspaces = __esm(() => {
+  init_config();
+});
+
+// packages/workit-core/src/core/git.ts
+var init_git = () => {};
+
+// packages/workit-core/src/core/vcs-config.ts
+var init_vcs_config = __esm(() => {
+  init_config();
+  init_workspaces();
+  init_branch();
+});
+
+// packages/workit-core/src/core/branch.ts
+import { execFileSync } from "node:child_process";
+var verifyPushIdentity = (root, provider, account) => {
+  if (!account || typeof account !== "string")
+    return { ok: false, error: "push identity requires a configured area account" };
+  const probe = provider === "gitlab" ? ["api", "user", "--jq", ".username"] : ["api", "user", "--jq", ".login"];
+  const bin = provider === "gitlab" ? "glab" : "gh";
+  let login;
+  try {
+    login = execFileSync(bin, [...probe], {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return { ok: false, error: `${bin} identity could not be resolved` };
+  }
+  if (!login || login.toLowerCase() !== account.toLowerCase())
+    return {
+      ok: false,
+      error: `push identity ${login || "(unknown)"} does not match area account ${account}`
+    };
+  return { ok: true };
+};
+var init_branch = __esm(() => {
+  init_git();
+  init_config();
+  init_workspaces();
+  init_vcs_config();
+});
+
+// packages/workit-core/src/core/auto-approval.ts
 import { createHash as createHash3 } from "node:crypto";
+import { readFileSync as readFileSync4 } from "node:fs";
+var AUTO_CLASSES, OPERATION_CLASS, operationAutoClass = (operation) => typeof operation === "string" ? OPERATION_CLASS[operation] ?? null : null, digestOf = (configDirPath) => {
+  try {
+    const raw = readFileSync4(`${configDirPath}/workspaces.json`, "utf8");
+    return createHash3("sha256").update(raw).digest("hex");
+  } catch {
+    return null;
+  }
+}, normalizeClasses = (value) => {
+  if (value === true)
+    return [...AUTO_CLASSES];
+  if (!Array.isArray(value))
+    return [];
+  const seen = new Set;
+  for (const item of value) {
+    if (typeof item === "string" && AUTO_CLASSES.includes(item))
+      seen.add(item);
+  }
+  return [...seen];
+}, resolveAutoApproval = (root, dir = configDir()) => {
+  let match;
+  try {
+    match = resolveWorkspaceFrom(root, dir);
+  } catch {
+    return { status: "off" };
+  }
+  if (!match)
+    return { status: "off" };
+  const classes = normalizeClasses(match.autoApprove);
+  if (classes.length === 0)
+    return { status: "off" };
+  return {
+    status: "on",
+    workspace: match.name,
+    classes,
+    account: typeof match.vcs?.account === "string" && match.vcs.account ? match.vcs.account : null,
+    configDigest: digestOf(dir)
+  };
+}, isStandingReceipt = (value) => typeof value === "object" && value !== null && value.kind === "standing", standingApprovalLive = (root, receipt, cls, dir) => {
+  if (!isStandingReceipt(receipt))
+    return false;
+  if (typeof cls !== "string" || !AUTO_CLASSES.includes(cls))
+    return false;
+  if (receipt.class !== cls)
+    return false;
+  const resolved = resolveAutoApproval(root, dir);
+  if (resolved.status !== "on")
+    return false;
+  if (resolved.workspace !== receipt.workspace)
+    return false;
+  return resolved.classes.includes(cls);
+}, standingReceiptFor = (root, workspace, cls, dir) => {
+  const resolved = resolveAutoApproval(root, dir);
+  return {
+    kind: "standing",
+    workspace,
+    class: cls,
+    configDigest: resolved.status === "on" && resolved.workspace === workspace ? resolved.configDigest : null
+  };
+}, verifyStandingApproval = (root, task, caller, binding) => {
+  if (task.status !== "active")
+    return failure("invalid_transition", "only active tasks can authorize actions");
+  const session = task.intent?.provenance?.session;
+  if (!session || session.kind !== "host" || session.host !== caller.host || session.handle !== caller.actor)
+    return failure("permission_denied", "standing approval requires the lead session");
+  const standing = binding.standing;
+  if (!standing || typeof standing.workspace !== "string" || typeof standing.class !== "string")
+    return failure("invalid_input", "standing approval needs a workspace and class");
+  let operation;
+  try {
+    operation = typeof binding.approvedContent === "string" ? JSON.parse(binding.approvedContent).operation : null;
+  } catch {
+    operation = null;
+  }
+  const cls = operationAutoClass(operation);
+  if (!cls || cls !== standing.class)
+    return failure("permission_denied", "standing approval does not cover this operation");
+  const resolved = resolveAutoApproval(root);
+  if (resolved.status !== "on" || resolved.workspace !== standing.workspace || !resolved.classes.includes(cls))
+    return failure("permission_denied", "standing auto-approval is not live for this operation");
+  if (cls === "push") {
+    const workspace = resolveWorkspaceFrom(root, configDir());
+    const provider = workspace?.vcs?.provider;
+    const account = resolved.account;
+    if (!provider || !account)
+      return failure("permission_denied", "auto-push requires a workspace provider and area account");
+    const identity = verifyPushIdentity(root, provider, account);
+    if (!identity.ok)
+      return failure("permission_denied", identity.error);
+  }
+  return success(null, null, {
+    kind: "host_observed",
+    host: caller.host,
+    session: { kind: "host", host: caller.host, handle: caller.actor },
+    workerId: null,
+    receipts: [standingReceiptFor(root, standing.workspace, cls)]
+  });
+};
+var init_auto_approval = __esm(() => {
+  init_workspaces();
+  init_config();
+  init_branch();
+  init_task_contract();
+  AUTO_CLASSES = ["branch", "commit", "push", "pr", "merge"];
+  OPERATION_CLASS = {
+    "git.branch_setup": "branch",
+    "git.commit": "commit",
+    "git.push": "push",
+    "hosting.pull_request": "pr",
+    "hosting.merge": "merge"
+  };
+});
+
+// packages/workit-core/src/core/authority.ts
+import { createHash as createHash4 } from "node:crypto";
 import * as fs5 from "node:fs";
-import path5 from "node:path";
+import path7 from "node:path";
 function applicableDecision(task, purpose, binding, checkoutRoot) {
   if (binding.taskId !== task.id || binding.workspaceId !== task.workspaceId)
     return [];
@@ -10199,7 +10556,7 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
   const record = verifiedAuthorities.get(authority);
   verifiedAuthorities.delete(authority);
   return record?.provenance ?? null;
-}, authorityMatches = (authority, expected) => authority.kind === "action" && authority.taskId === expected.taskId && authority.workspaceId === expected.workspaceId && authority.decisionId === expected.decisionId && sameRef(authority.actionRef, expected.actionRef) && authority.taskRevision === expected.taskRevision && authority.workspaceRevision === expected.workspaceRevision && authority.outcome === expected.outcome, authorityDecisionMatches = (authority, decision) => authority.purpose === decision.purpose && authority.response === decision.response && authority.digest === decision.digest && canonicalJson(authority.binding) === canonicalJson(decision.binding) && canonicalJson(authority.requirementIds) === canonicalJson(decision.requirementIds), provenanceMatches = (left, right) => left.kind === "host_observed" && right.kind === "host_observed" && left.host === right.host && canonicalJson(left.session) === canonicalJson(right.session), digestBytes2 = (bytes) => createHash3("sha256").update(bytes).digest("hex"), verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
+}, authorityMatches = (authority, expected) => authority.kind === "action" && authority.taskId === expected.taskId && authority.workspaceId === expected.workspaceId && authority.decisionId === expected.decisionId && sameRef(authority.actionRef, expected.actionRef) && authority.taskRevision === expected.taskRevision && authority.workspaceRevision === expected.workspaceRevision && authority.outcome === expected.outcome, authorityDecisionMatches = (authority, decision) => authority.purpose === decision.purpose && authority.response === decision.response && authority.digest === decision.digest && canonicalJson(authority.binding) === canonicalJson(decision.binding) && canonicalJson(authority.requirementIds) === canonicalJson(decision.requirementIds), provenanceMatches = (left, right) => left.kind === "host_observed" && right.kind === "host_observed" && left.host === right.host && canonicalJson(left.session) === canonicalJson(right.session), digestBytes2 = (bytes) => createHash4("sha256").update(bytes).digest("hex"), verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
     root = fs5.realpathSync(checkoutRoot);
@@ -10211,23 +10568,23 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
       continue;
     if (!reference.digest)
       return failure("invalid_input", "document references require a byte digest");
-    const target = path5.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path5.sep}`))
+    const target = path7.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path7.sep}`))
       return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const relative = path5.relative(root, target);
+      const relative = path7.relative(root, target);
       let current = root;
-      for (const segment of relative.split(path5.sep)) {
+      for (const segment of relative.split(path7.sep)) {
         if (!segment)
           continue;
-        current = path5.join(current, segment);
+        current = path7.join(current, segment);
         const stat = fs5.lstatSync(current);
         const real = fs5.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path5.sep}`))
+        if (real !== root && !real.startsWith(`${root}${path7.sep}`))
           return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -10277,6 +10634,20 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
     return failure("permission_denied", "decision was rejected");
   if (entry.provenance.kind !== "host_observed" || entry.provenance.receipts.length === 0 || !provenanceMatches(entry.provenance, authority.provenance))
     return failure("permission_denied", "action approval lacks native receipt assurance");
+  const receipts = entry.provenance.receipts;
+  const standing = receipts.filter((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "standing");
+  const questionBacked = receipts.some((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "host");
+  if (!questionBacked && standing.length > 0) {
+    let operation;
+    try {
+      operation = JSON.parse(decision.binding.approvedContent).operation;
+    } catch {
+      operation = null;
+    }
+    const cls = operationAutoClass(operation);
+    if (!cls || !standing.some((receipt) => standingApprovalLive(store.root, receipt, cls)))
+      return failure("permission_denied", "standing auto-approval is not live for this operation");
+  }
   if (decision.revoked)
     return failure("permission_denied", "decision is revoked");
   if (decision.digest !== decisionDigest(decision))
@@ -10300,6 +10671,7 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
   return success(null, null, { entry, workflow });
 }, bindingCovers, verifyDecisionContent;
 var init_authority = __esm(() => {
+  init_auto_approval();
   init_task_contract();
   verifiedAuthorities = new WeakMap;
   bindingCovers = scopeCovers;
@@ -10307,10 +10679,10 @@ var init_authority = __esm(() => {
 });
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import * as fs6 from "node:fs";
 import { spawnSync } from "node:child_process";
-import path6 from "node:path";
+import path8 from "node:path";
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
@@ -10352,7 +10724,7 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].sort()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path6.join(checkout, item);
+    const target = path8.join(checkout, item);
     try {
       const stat = fs6.lstatSync(target);
       if (stat.isSymbolicLink()) {
@@ -10623,12 +10995,12 @@ function evaluateClosure(requestedOutcome, view) {
     requirementIds: evaluations.map((item) => item.requirementId)
   });
 }
-var digestBytes3 = (value) => createHash4("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path6.sep}`), relative = (root, candidate) => path6.relative(root, candidate).split(path6.sep).join("/") || ".", canonicalPath = (value) => {
+var digestBytes3 = (value) => createHash5("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path8.sep}`), relative = (root, candidate) => path8.relative(root, candidate).split(path8.sep).join("/") || ".", canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path6.posix.normalize(value);
+  const normalized = path8.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -10670,14 +11042,14 @@ var digestBytes3 = (value) => createHash4("sha256").update(value).digest("hex"),
       git: /not a git repository/i.test(stderr) ? false : true
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path6.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path8.sep).join("/")) : [];
   const stagedDeleted = spawnSync("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path6.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path8.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 }, walk = (root, directory, output) => {
@@ -10691,7 +11063,7 @@ var digestBytes3 = (value) => createHash4("sha256").update(value).digest("hex"),
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path6.join(directory, name);
+    const target = path8.join(directory, name);
     let stat;
     try {
       stat = fs6.lstatSync(target);
@@ -10708,12 +11080,12 @@ var digestBytes3 = (value) => createHash4("sha256").update(value).digest("hex"),
 }, scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path6.resolve(root, item);
+    const target = path8.resolve(root, item);
     if (!inside(root, target))
       return failure("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
     while (!fs6.existsSync(ancestor) && ancestor !== root)
-      ancestor = path6.dirname(ancestor);
+      ancestor = path8.dirname(ancestor);
     try {
       if (!inside(root, fs6.realpathSync(ancestor)))
         return failure("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
@@ -10991,58 +11363,6 @@ var init_route_intent = __esm(() => {
   init_task_store();
 });
 
-// packages/workit-core/src/core/git.ts
-var init_git = () => {};
-
-// packages/workit-core/src/core/boundary.ts
-var init_boundary = () => {};
-
-// packages/workit-core/src/core/config.ts
-var PRESETS, DEFAULTS;
-var init_config = __esm(() => {
-  init_boundary();
-  PRESETS = {
-    gitflow: {
-      allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
-      protected: ["main", "develop", "master", "prod", "production"]
-    },
-    "github-flow": { allowed: ["*"], protected: ["main"] },
-    "trunk-based": { allowed: ["*"], protected: ["main"] },
-    custom: { allowed: [], protected: [] }
-  };
-  DEFAULTS = {
-    locale: "en",
-    localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
-    timezone: "America/Santiago",
-    branchPolicy: {
-      preset: "gitflow",
-      allowed: [...PRESETS.gitflow.allowed],
-      protected: [...PRESETS.gitflow.protected]
-    },
-    commitPolicy: { preset: "conventional" }
-  };
-});
-
-// packages/workit-core/src/core/workspaces.ts
-var init_workspaces = __esm(() => {
-  init_config();
-});
-
-// packages/workit-core/src/core/vcs-config.ts
-var init_vcs_config = __esm(() => {
-  init_config();
-  init_workspaces();
-  init_branch();
-});
-
-// packages/workit-core/src/core/branch.ts
-var init_branch = __esm(() => {
-  init_git();
-  init_config();
-  init_workspaces();
-  init_vcs_config();
-});
-
 // packages/workit-core/src/core/runtime-identity.ts
 var init_runtime_identity = () => {};
 
@@ -11084,6 +11404,13 @@ var init_external_action = __esm(() => {
         babysit: boolean2().optional()
       }).strict()
     }).strict(),
+    object({
+      operation: literal("hosting.merge"),
+      payload: object({
+        target_branch: string2().min(1).optional(),
+        source_branch: string2().min(1).optional()
+      }).strict()
+    }).strict(),
     object({
       operation: literal("youtrack.update"),
       payload: object({
@@ -11464,7 +11791,7 @@ var init_policy_resolver = __esm(() => {
 });
 
 // packages/workit-core/src/core/task-engine.ts
-import { realpathSync as realpathSync4 } from "node:fs";
+import { realpathSync as realpathSync5 } from "node:fs";
 
 class WorkitCore {
   store;
@@ -11479,7 +11806,7 @@ class WorkitCore {
   }
   contextRootError() {
     try {
-      if (realpathSync4(this.context.root) !== this.store.root)
+      if (realpathSync5(this.context.root) !== this.store.root)
         return failure("invalid_input", "operation context root does not match the task store root");
     } catch {
       return failure("invalid_input", "operation context root cannot be resolved");
@@ -11825,7 +12152,10 @@ class WorkitCore {
   observeDecision(request, observation) {
     return this.recordDecision(request, observation, true);
   }
-  recordDecision(request, nativeObservation, nativeRequired = false) {
+  observeStandingDecision(request) {
+    return this.recordDecision(request, undefined, true, true);
+  }
+  recordDecision(request, nativeObservation, nativeRequired = false, standing = false) {
     const root = this.contextRootError();
     if (!root.ok)
       return root;
@@ -11840,8 +12170,10 @@ class WorkitCore {
       return failure("permission_denied", "stated choices cannot authorize mutating actions");
     if (stated && !input.binding?.statedChoice)
       return failure("invalid_input", "stated choices require binding.statedChoice");
-    if (nativeRequired && nativeObservation === undefined && !stated)
+    if (nativeRequired && nativeObservation === undefined && !stated && !standing)
       return failure("permission_denied", "native decision observation is required");
+    if (standing && (!input.binding?.standing || input.purpose !== "action" || input.response !== "approved"))
+      return failure("invalid_input", "standing approvals need an approved action binding with a standing rule");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
       return task;
@@ -11873,7 +12205,10 @@ class WorkitCore {
         consumption: null
       };
       const data = { ...base, digest: decisionDigest(base) };
-      const native = nativeRequired && !stated ? verifyNativeDecision(this.context.nativeAuthority, {
+      const standingApproval = standing && !stated ? verifyStandingApproval(this.store.root, task.data, this.context.caller, input.binding) : null;
+      if (standingApproval && !standingApproval.ok)
+        return standingApproval;
+      const native = nativeRequired && !stated && !standingApproval ? verifyNativeDecision(this.context.nativeAuthority, {
         observation: nativeObservation,
         expected: {
           taskId: task.data.id,
@@ -11904,7 +12239,7 @@ class WorkitCore {
         const entry = {
           id: newId(),
           recordedAt: mutation.now,
-          provenance: nativeProvenance ?? provenance(this.context, "agent_reported"),
+          provenance: standingApproval?.ok === true ? standingApproval.data : nativeProvenance ?? provenance(this.context, "agent_reported"),
           data
         };
         return success(mutation.revision, null, {
@@ -12732,7 +13067,7 @@ class WorkitCore {
     if (view.task.workspaceId !== view.workspace.id)
       return failure("invalid_input", "task and workspace bindings are invalid");
     try {
-      if (realpathSync4(view.workspace.root) !== this.store.root)
+      if (realpathSync5(view.workspace.root) !== this.store.root)
         return failure("invalid_input", "task view root does not match the task store");
     } catch {
       return failure("invalid_input", "task view root cannot be resolved");
@@ -13330,6 +13665,7 @@ var init_task_engine = __esm(() => {
   init_task_contract();
   init_authority();
   init_policy_resolver();
+  init_auto_approval();
   init_task_context();
   init_workers();
   init_task_evaluation();
@@ -13345,6 +13681,7 @@ var init_core3 = __esm(() => {
   init_methods();
   init_route_intent();
   init_branch();
+  init_auto_approval();
   init_runtime_identity();
   init_authority();
   init_authority();
@@ -13356,8 +13693,8 @@ var init_core3 = __esm(() => {
 });
 
 // packages/workit-cursor/hooks/workit-hook.ts
-import { existsSync as existsSync4, realpathSync as realpathSync5 } from "node:fs";
-import path7 from "node:path";
+import { existsSync as existsSync5, realpathSync as realpathSync6 } from "node:fs";
+import path9 from "node:path";
 var hostRef = (handle) => ({ kind: "host", host: "cursor", handle }), cursorCapabilities = (availability = {}) => {
   const has = (name) => availability[name] === true;
   return [
@@ -13418,7 +13755,7 @@ var hostRef = (handle) => ({ kind: "host", host: "cursor", handle }), cursorCapa
   if (!Array.isArray(roots) || roots.length !== 1 || !roots.every(nonEmpty2))
     return { ok: false, error: "exactly one workspace root is required" };
   const root = roots[0];
-  if (!path7.isAbsolute(root) || !existsSync4(root))
+  if (!path9.isAbsolute(root) || !existsSync5(root))
     return { ok: false, error: "workspace root must be an existing absolute path" };
   const event = value.hook_event_name;
   const conversationId = nonEmpty2(value.conversation_id) ? value.conversation_id : undefined;
@@ -13553,7 +13890,7 @@ var hostRef = (handle) => ({ kind: "host", host: "cursor", handle }), cursorCapa
     return isRecord2(raw) && raw.hook_event_name === "sessionStart" ? {} : deny(parsed.error);
   }
   const input = parsed.data;
-  const root = realpathSync5(input.workspace_roots[0]);
+  const root = realpathSync6(input.workspace_roots[0]);
   if (input.hook_event_name === "sessionStart") {
     const actor = input.session_id ?? input.conversation_id;
     let compact = "";