@brainervirus/workit-cursor 8.11.0 → 8.12.1

package/dist/workit-hook.js

@@ -8377,7 +8377,7 @@ import { realpathSync as realpathSync4 } from "node:fs";
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync2 } from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // packages/workit-core/src/git/rev.ts
 import { spawnSync } from "node:child_process";
@@ -8564,7 +8564,7 @@ function pushRemoteName(cwd, branch) {
 import { spawnSync as spawnSync7 } from "node:child_process";
 import { createHash as createHash7, randomBytes } from "node:crypto";
 import fs5 from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 
 // packages/workit-core/src/core/vcs-config.ts
 import fs2 from "node:fs";
@@ -8921,6 +8921,7 @@ var workspaceConfigSchema = object({
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
   defaultEndpoint: unknown().optional(),
   verification: _enum(["self", "independent"]).optional(),
+  trailers: boolean2().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -9202,8 +9203,8 @@ var resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd,
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
-var matchRuntimeWorkspace = (cwd) => {
-  const file = path3.join(configDir(), "workspaces.json");
+var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
+  const file = path3.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync2(file, "utf8");
@@ -9232,12 +9233,30 @@ var matchRuntimeWorkspace = (cwd) => {
   const matches = matchingEntries(cwd, entries ?? []);
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  return selected ? { file, selected } : null;
+  return selected ? { file, selected, matches } : null;
 };
 var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
 };
+var workspaceTrailers = (cwd, dir) => {
+  let matched;
+  try {
+    matched = matchRuntimeWorkspace(cwd, dir);
+  } catch {
+    return { enabled: true, workspace: null, from: null };
+  }
+  if (!matched)
+    return { enabled: true, workspace: null, from: null };
+  const { selected, matches } = matched;
+  const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return {
+    enabled: source?.trailers !== false,
+    workspace: selected.name,
+    from: source?.name ?? null
+  };
+};
 var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   const matched = matchRuntimeWorkspace(cwd);
   if (!matched)
@@ -9802,13 +9821,72 @@ function vcsConfig(mode, cwd, options = {}) {
 // packages/workit-core/src/host-session.ts
 import { createHash as createHash6 } from "node:crypto";
 import fs4 from "node:fs";
-import path6 from "node:path";
+import path7 from "node:path";
+
+// packages/workit-core/src/core/logger.ts
+import os3 from "node:os";
+import path5 from "node:path";
+var SENSITIVE_WORDS = new Set([
+  "token",
+  "secret",
+  "password",
+  "passwd",
+  "authorization",
+  "credential",
+  "credentials",
+  "cookie",
+  "api",
+  "apikey",
+  "apitoken",
+  "accesstoken",
+  "clientsecret",
+  "refreshtoken",
+  "key",
+  "bearer",
+  "prompt",
+  "message",
+  "messages",
+  "content",
+  "body",
+  "args",
+  "argument",
+  "result",
+  "results",
+  "output",
+  "issue",
+  "description",
+  "summary",
+  "payload",
+  "script",
+  "command",
+  "text",
+  "query"
+]);
+var STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
+var escapeRegExp2 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var resolveStateDir = () => {
+  const override = process.env.WORKFLOW_TOOLKIT_STATE;
+  if (override)
+    return override;
+  const home = os3.homedir();
+  if (process.env.XDG_STATE_HOME)
+    return path5.join(process.env.XDG_STATE_HOME, "workit");
+  switch (os3.platform()) {
+    case "darwin":
+      return path5.join(home, "Library", "Application Support", "workit");
+    case "win32":
+      return path5.join(process.env.LOCALAPPDATA ?? path5.join(home, "AppData", "Local"), "workit");
+    default:
+      return path5.join(process.env.HOME ?? home, ".local", "state", "workit");
+  }
+};
+var homePattern = new RegExp(`${escapeRegExp2(os3.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
 
 // packages/workit-core/src/store/paths.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import fs3 from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
 var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
 var gitRun = (cwd, args) => {
   const run = spawnSync6("git", args, {
@@ -9850,14 +9928,14 @@ var DISCOVERY_ENV = [
 ];
 var isGitDir = (dir) => {
   try {
-    return fs3.statSync(path5.join(dir, "HEAD")).isFile() && fs3.statSync(path5.join(dir, "objects")).isDirectory() && fs3.statSync(path5.join(dir, "refs")).isDirectory();
+    return fs3.statSync(path6.join(dir, "HEAD")).isFile() && fs3.statSync(path6.join(dir, "objects")).isDirectory() && fs3.statSync(path6.join(dir, "refs")).isDirectory();
   } catch {
     return false;
   }
 };
 var reftableRefs = (common) => {
   try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs3.readFileSync(path5.join(common, "config"), "utf8"));
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs3.readFileSync(path6.join(common, "config"), "utf8"));
   } catch {
     return false;
   }
@@ -9877,7 +9955,7 @@ function fastGit(root) {
     if (device !== null && stat.dev !== device)
       return { kind: "none" };
     device = stat.dev;
-    const dotGit = path5.join(dir, ".git");
+    const dotGit = path6.join(dir, ".git");
     let entry = null;
     try {
       entry = fs3.statSync(dotGit);
@@ -9898,19 +9976,19 @@ function fastGit(root) {
         const match = /^gitdir: (.+)$/mu.exec(text);
         if (!match)
           return null;
-        gitDir = path5.resolve(dir, match[1].trim());
+        gitDir = path6.resolve(dir, match[1].trim());
       } else
         return null;
-      if (!fs3.existsSync(path5.join(gitDir, "HEAD")))
+      if (!fs3.existsSync(path6.join(gitDir, "HEAD")))
         return null;
     } else if (isGitDir(dir))
       gitDir = dir;
     if (gitDir) {
       let common = gitDir;
       try {
-        common = path5.resolve(gitDir, fs3.readFileSync(path5.join(gitDir, "commondir"), "utf8").trim());
+        common = path6.resolve(gitDir, fs3.readFileSync(path6.join(gitDir, "commondir"), "utf8").trim());
       } catch {}
-      if (!fs3.existsSync(path5.join(common, "objects")))
+      if (!fs3.existsSync(path6.join(common, "objects")))
         return null;
       return {
         kind: "repo",
@@ -9920,26 +9998,26 @@ function fastGit(root) {
         reftable: reftableRefs(common)
       };
     }
-    const parent = path5.dirname(dir);
+    const parent = path6.dirname(dir);
     if (parent === dir)
       return { kind: "none" };
     dir = parent;
   }
 }
 function resolveStore(root) {
-  root = path5.resolve(root);
+  root = path6.resolve(root);
   let directory = false;
   try {
     directory = fs3.statSync(root).isDirectory();
   } catch {}
   if (!directory)
-    return { dir: path5.join(root, ".workit"), shared: false, top: null };
+    return { dir: path6.join(root, ".workit"), shared: false, top: null };
   const fast = fastGit(root);
   if (fast?.kind === "none")
-    return { dir: path5.join(root, ".workit"), shared: false, top: null };
+    return { dir: path6.join(root, ".workit"), shared: false, top: null };
   if (fast?.kind === "repo")
     return {
-      dir: path5.join(fast.common, "workit"),
+      dir: path6.join(fast.common, "workit"),
       shared: true,
       top: fast.top,
       git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
@@ -9949,20 +10027,20 @@ function resolveStore(root) {
   if (run.ok && common) {
     const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
     return {
-      dir: path5.join(real(path5.resolve(root, common)), "workit"),
+      dir: path6.join(real(path6.resolve(root, common)), "workit"),
       shared: true,
       top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
     };
   }
   if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path5.join(root, ".workit"), shared: false, top: null };
+    return { dir: path6.join(root, ".workit"), shared: false, top: null };
   return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
 `)[0] || "no output"}); fix the repository (git status should work here)`);
 }
 var rebasingBranch = (gitDir) => {
   for (const state of ["rebase-merge", "rebase-apply"]) {
     try {
-      const ref = fs3.readFileSync(path5.join(gitDir, state, "head-name"), "utf8").trim();
+      const ref = fs3.readFileSync(path6.join(gitDir, state, "head-name"), "utf8").trim();
       const match = /^refs\/heads\/(.+)$/u.exec(ref);
       if (match)
         return match[1];
@@ -9977,7 +10055,7 @@ function resolveTaskKey(root, location) {
   if (location.git && !location.git.reftable) {
     let head = "";
     try {
-      head = fs3.readFileSync(path5.join(location.git.gitDir, "HEAD"), "utf8").trim();
+      head = fs3.readFileSync(path6.join(location.git.gitDir, "HEAD"), "utf8").trim();
     } catch {}
     const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
     if (ref && ref[1] !== ".invalid")
@@ -10008,7 +10086,7 @@ function resolveTaskKey(root, location) {
   return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
 }
 function checkoutRootOf(root, location) {
-  const resolved = path5.resolve(root);
+  const resolved = path6.resolve(root);
   let canonical = resolved;
   try {
     canonical = fs3.realpathSync(resolved);
@@ -10039,13 +10117,13 @@ function branchRenames(location) {
     }
     for (const entry of entries)
       if (entry.isDirectory())
-        walk(path5.join(dir, entry.name));
+        walk(path6.join(dir, entry.name));
       else
-        files.push(path5.join(dir, entry.name));
+        files.push(path6.join(dir, entry.name));
   };
-  walk(path5.join(path5.dirname(location.dir), "logs", "refs", "heads"));
+  walk(path6.join(path6.dirname(location.dir), "logs", "refs", "heads"));
   if (location.git)
-    files.push(path5.join(location.git.gitDir, "logs", "HEAD"));
+    files.push(path6.join(location.git.gitDir, "logs", "HEAD"));
   const seen = new Set;
   const renames = [];
   for (const file of files) {
@@ -10080,7 +10158,7 @@ var checkoutSlug = (root) => {
   let canonical = real(root);
   if (process.platform === "win32")
     canonical = canonical.toLowerCase();
-  const base = path5.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  const base = path6.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
   return `${base}-${shortHash(canonical)}`;
 };
 
@@ -10113,30 +10191,64 @@ function hostSessionFromEnv(env) {
   return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
 }
 var ISSUED_PER_LEAD = 64;
-var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/1";
+var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/2";
 var hash = (value) => createHash6("sha256").update(value).digest("hex").slice(0, 32);
-var issuedRoot = (cwd) => {
-  const location = resolveStore(cwd);
-  return location instanceof Error ? null : path6.join(location.dir, "hooks", "issued");
+var userIssuedRoot = () => path7.join(resolveStateDir(), "issued");
+function migrateRepoIssued(cwd) {
+  if (cwd === undefined)
+    return;
+  let old;
+  try {
+    const location = resolveStore(cwd);
+    if (location instanceof Error)
+      return;
+    old = path7.join(location.dir, "hooks", "issued");
+    if (!fs4.existsSync(old))
+      return;
+  } catch {
+    return;
+  }
+  for (const lead of safeList(old)) {
+    try {
+      const from = path7.join(old, lead);
+      if (!fs4.statSync(from).isDirectory())
+        continue;
+      const to = path7.join(userIssuedRoot(), lead);
+      fs4.mkdirSync(to, { recursive: true, mode: 448 });
+      for (const id of fs4.readdirSync(from)) {
+        fs4.copyFileSync(path7.join(from, id), path7.join(to, id));
+        fs4.rmSync(path7.join(from, id), { force: true });
+      }
+      removeIfEmpty(from);
+    } catch {}
+  }
+  removeIfEmpty(old);
+}
+var safeList = (dir) => {
+  try {
+    return fs4.readdirSync(dir);
+  } catch {
+    return [];
+  }
 };
-var issuedDir = (cwd, lead) => {
-  const root = issuedRoot(cwd);
-  return root === null ? null : path6.join(root, hash(lead));
+var removeIfEmpty = (dir) => {
+  try {
+    fs4.rmdirSync(dir);
+  } catch {}
 };
 function recordIssuedSession(cwd, lead, issued) {
   try {
-    const dir = issuedDir(cwd, lead);
-    if (!dir)
-      return;
-    fs4.mkdirSync(dir, { recursive: true });
+    migrateRepoIssued(cwd);
+    const dir = path7.join(userIssuedRoot(), hash(lead));
+    fs4.mkdirSync(dir, { recursive: true, mode: 448 });
     const own = hash(issued);
-    fs4.writeFileSync(path6.join(dir, own), ISSUED_SESSIONS_MARKER);
+    fs4.writeFileSync(path7.join(dir, own), ISSUED_SESSIONS_MARKER);
     const entries = fs4.readdirSync(dir);
     if (entries.length <= ISSUED_PER_LEAD)
       return;
-    const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs4.statSync(path6.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
+    const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs4.statSync(path7.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
     for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD))
-      fs4.rmSync(path6.join(dir, name), { force: true });
+      fs4.rmSync(path7.join(dir, name), { force: true });
   } catch {}
 }
 var OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
@@ -10258,14 +10370,14 @@ function diffHash(cwd, base, head) {
   return `sha256:${hash.digest("hex")}`;
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path7.resolve(cwd));
+  const location = resolveStore(path8.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path7.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path8.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 var newId2 = () => `${Date.now().toString(36)}-${randomBytes(6).toString("hex")}`;
 var NETWORK_FS_TYPES = new Set([
@@ -10295,13 +10407,13 @@ var LOCK_STALE_MS = 30000;
 var LOCK_OWNER = "owner";
 var lockToken = (lock) => {
   try {
-    return fs5.readFileSync(path7.join(lock, LOCK_OWNER), "utf8");
+    return fs5.readFileSync(path8.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 };
 var lockAgeMs = (lock) => {
-  for (const target of [path7.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path8.join(lock, LOCK_OWNER), lock]) {
     try {
       return Date.now() - fs5.statSync(target).mtimeMs;
     } catch {}
@@ -10318,7 +10430,7 @@ var ledgerLock = {
       throw error;
     }
     const token = `${process.pid}-${randomBytes(8).toString("hex")}`;
-    fs5.writeFileSync(path7.join(lock, LOCK_OWNER), token);
+    fs5.writeFileSync(path8.join(lock, LOCK_OWNER), token);
     return token;
   },
   release(lock, token) {
@@ -10443,8 +10555,8 @@ function appendLine(file, build, options) {
     }
   };
   try {
-    fs5.mkdirSync(path7.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path7.dirname(file)))
+    fs5.mkdirSync(path8.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path8.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -11007,7 +11119,7 @@ var productDecision = (task, ledger) => {
   };
 };
 var planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync2(path8.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync2(path9.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -11622,20 +11734,20 @@ var judgeInputSummary = (raw) => {
 };
 
 // packages/workit-core/src/autonomy.ts
-import os3 from "node:os";
-import path9 from "node:path";
+import os4 from "node:os";
+import path10 from "node:path";
 var accountHome = () => {
   try {
-    return os3.userInfo().homedir;
+    return os4.userInfo().homedir;
   } catch {
-    return os3.homedir();
+    return os4.homedir();
   }
 };
 var grantsHome = { resolve: accountHome };
-var grantsDir = () => path9.join(grantsHome.resolve(), ".config", "workit");
+var grantsDir = () => path10.join(grantsHome.resolve(), ".config", "workit");
 var grantsOverride = () => {
-  const configured = path9.resolve(resolveConfigDir());
-  return configured === path9.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path9.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+  const configured = path10.resolve(resolveConfigDir());
+  return configured === path10.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path10.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 };
 var GRANT_KINDS = ["push", "pr", "merge", "release", "rerun"];
 var DEFAULT_GRANTS = Object.freeze({
@@ -11761,7 +11873,7 @@ var grantHint = (workspace, kind) => `ask the user to run, in their own terminal
 // packages/workit-core/src/core/task-store.ts
 import { createHash as createHash9, randomUUID as randomUUID3 } from "node:crypto";
 import * as fs11 from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/errors.js
 var OPERATIONAL_CODES = new Set([
@@ -11812,7 +11924,7 @@ function sameFileIdentity(left, right, platform = process.platform) {
 // node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
 import { randomBytes as randomBytes2 } from "node:crypto";
 import fsSync from "node:fs";
-import path10 from "node:path";
+import path11 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/bounded-read.js
 import fs6 from "node:fs";
@@ -11902,13 +12014,13 @@ ${ownershipToken}
   return { raw, ownershipToken };
 }
 function relativeSidecarLockPath(lockRoot, lockPath) {
-  const resolved = path10.resolve(lockPath);
-  const lexicalRelative = path10.relative(lockRoot.rootDir, resolved);
-  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(lexicalRelative) ? lexicalRelative : path10.relative(lockRoot.rootReal, resolved);
-  if (!relative || relative === ".." || relative.startsWith(`..${path10.sep}`) || path10.isAbsolute(relative)) {
+  const resolved = path11.resolve(lockPath);
+  const lexicalRelative = path11.relative(lockRoot.rootDir, resolved);
+  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path11.sep}`) && !path11.isAbsolute(lexicalRelative) ? lexicalRelative : path11.relative(lockRoot.rootReal, resolved);
+  if (!relative || relative === ".." || relative.startsWith(`..${path11.sep}`) || path11.isAbsolute(relative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock path is outside lockRoot");
   }
-  return relative.split(path10.sep).join(path10.posix.sep);
+  return relative.split(path11.sep).join(path11.posix.sep);
 }
 function parseSidecarLockPayload(raw, parser) {
   if (parser) {
@@ -12055,7 +12167,7 @@ function getFsSafeLockConfig() {
 
 // node_modules/@openclaw/fs-safe/dist/file-lock-sync.js
 import fs8 from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/timing.js
 function sleepSync(ms) {
@@ -12146,26 +12258,26 @@ function canonicalLockParentSync(parent) {
   return process.platform === "win32" ? fs8.realpathSync.native(parent) : fs8.realpathSync(parent);
 }
 function normalizeTargetPath(targetPath) {
-  const resolved = path11.resolve(targetPath);
-  fs8.mkdirSync(path11.dirname(resolved), { recursive: true });
+  const resolved = path12.resolve(targetPath);
+  fs8.mkdirSync(path12.dirname(resolved), { recursive: true });
   try {
-    return path11.join(canonicalLockParentSync(path11.dirname(resolved)), path11.basename(resolved));
+    return path12.join(canonicalLockParentSync(path12.dirname(resolved)), path12.basename(resolved));
   } catch {
     return resolved;
   }
 }
 function boundedLockPath(lockPath, lockRoot) {
-  const resolved = path11.resolve(lockPath);
+  const resolved = path12.resolve(lockPath);
   if (!lockRoot)
     return resolved;
   relativeSidecarLockPath(lockRoot, resolved);
-  const parent = path11.dirname(resolved);
+  const parent = path12.dirname(resolved);
   const parentReal = canonicalLockParentSync(parent);
-  const parentRelative = path11.relative(lockRoot.rootReal, parentReal);
-  if (parentRelative === ".." || parentRelative.startsWith(`..${path11.sep}`) || path11.isAbsolute(parentRelative)) {
+  const parentRelative = path12.relative(lockRoot.rootReal, parentReal);
+  if (parentRelative === ".." || parentRelative.startsWith(`..${path12.sep}`) || path12.isAbsolute(parentRelative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock parent is outside lockRoot");
   }
-  return path11.join(parentReal, path11.basename(resolved));
+  return path12.join(parentReal, path12.basename(resolved));
 }
 function defaultShouldReclaim(snapshot, staleMs, nowMs) {
   const createdAtMs = sidecarLockPayloadCreatedAtMs(snapshot.payload);
@@ -12366,13 +12478,13 @@ function acquireFileLockSync(targetPath, options) {
 }
 // packages/workit-core/src/core/package-root.ts
 import { existsSync as existsSync3 } from "node:fs";
-import path12 from "node:path";
+import path13 from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = () => {
-  let dir = path12.dirname(fileURLToPath(import.meta.url));
+  let dir = path13.dirname(fileURLToPath(import.meta.url));
   while (true) {
-    const parent = path12.dirname(dir);
-    if (existsSync3(path12.join(dir, "package.json")) || parent === dir)
+    const parent = path13.dirname(dir);
+    if (existsSync3(path13.join(dir, "package.json")) || parent === dir)
       return dir;
     dir = parent;
   }
@@ -12521,7 +12633,7 @@ var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs10 from "node:fs";
-import path13 from "node:path";
+import path14 from "node:path";
 var EVENT_VERSION = 1;
 
 class LogDamage extends Error {
@@ -12632,7 +12744,7 @@ function appendEvent(file, event, validEnd) {
     fs10.closeSync(fd);
   }
   if (created)
-    fsyncDirectory(path13.dirname(file));
+    fsyncDirectory(path14.dirname(file));
   return validEnd;
 }
 function replaceFile(file, bytes, durable) {
@@ -12648,7 +12760,7 @@ function replaceFile(file, bytes, durable) {
     }
     renameWithRetry(temporary, file);
     if (durable)
-      fsyncDirectory(path13.dirname(file));
+      fsyncDirectory(path14.dirname(file));
   } catch (error) {
     try {
       fs10.unlinkSync(temporary);
@@ -12991,7 +13103,7 @@ var cachedRuntimeVersion = null;
 var runtimeVersion = () => {
   if (cachedRuntimeVersion === null) {
     try {
-      const pkg = JSON.parse(fs11.readFileSync(path14.join(packageRoot(), "package.json"), "utf8"));
+      const pkg = JSON.parse(fs11.readFileSync(path15.join(packageRoot(), "package.json"), "utf8"));
       cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
     } catch {
       cachedRuntimeVersion = "0.0.0";
@@ -13024,7 +13136,7 @@ var readText = (file) => {
 };
 var REFLOG_LINE = /^[0-9a-f]+ ([0-9a-f]+) .* (\d+) [+-]\d{4}\t(.*)$/u;
 var branchStart = (location, branch, aliases) => {
-  const first = readText(path14.join(path14.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
+  const first = readText(path15.join(path15.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
 `, 1)[0];
   const created = REFLOG_LINE.exec(first);
   const start = created && /^branch: Created from (\S+)$/u.exec(created[3])?.[1];
@@ -13034,7 +13146,7 @@ var branchStart = (location, branch, aliases) => {
     return start;
   if (!location.git)
     return null;
-  for (const line of readText(path14.join(location.git.gitDir, "logs", "HEAD")).split(`
+  for (const line of readText(path15.join(location.git.gitDir, "logs", "HEAD")).split(`
 `)) {
     const entry = REFLOG_LINE.exec(line);
     const moved = entry && /^checkout: moving from (\S+) to (\S+)$/u.exec(entry[3]);
@@ -13044,14 +13156,14 @@ var branchStart = (location, branch, aliases) => {
   }
   return null;
 };
-var refExists = (common, ref) => fs11.existsSync(path14.join(common, ref)) || readText(path14.join(common, "packed-refs")).includes(` ${ref}
+var refExists = (common, ref) => fs11.existsSync(path15.join(common, ref)) || readText(path15.join(common, "packed-refs")).includes(` ${ref}
 `);
 var origins = new Map;
 var sameDirectoryIdentity = (left, right) => {
-  if (!path14.isAbsolute(left) || !path14.isAbsolute(right))
+  if (!path15.isAbsolute(left) || !path15.isAbsolute(right))
     return false;
-  const normalizedLeft = path14.resolve(left);
-  const normalizedRight = path14.resolve(right);
+  const normalizedLeft = path15.resolve(left);
+  const normalizedRight = path15.resolve(right);
   try {
     const a = fs11.statSync(normalizedLeft, { bigint: true });
     const b = fs11.statSync(normalizedRight, { bigint: true });
@@ -13097,7 +13209,7 @@ class TaskStore {
   migrationChecked = false;
   compactDue = new Set;
   constructor(root, options = {}) {
-    const resolved = path14.resolve(root);
+    const resolved = path15.resolve(root);
     this.origin = fs11.existsSync(resolved) ? fs11.realpathSync(resolved) : resolved;
     this.located = resolveStore(this.origin);
     this.root = checkoutRootOf(this.origin, this.located);
@@ -13106,7 +13218,7 @@ class TaskStore {
     this.migrateOnRead = options.migrateOnRead;
   }
   location() {
-    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs11.existsSync(path14.join(this.root, ".git"))) {
+    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs11.existsSync(path15.join(this.root, ".git"))) {
       this.located = undefined;
       this.migrationChecked = false;
     }
@@ -13262,7 +13374,7 @@ class TaskStore {
         const moved = this.bindLocked(again.data.id, key, input.now);
         return moved.ok ? success(moved.data.revision, null, { task: moved.data, created: false, key }) : moved;
       }
-      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path14.basename(this.root) || this.root;
+      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path15.basename(this.root) || this.root;
       const intent = {
         objective: input.objective?.trim() || `Work on ${label}`,
         scope: { description: `the checkout (${label})`, paths: ["."], exclusions: [] },
@@ -13322,14 +13434,14 @@ class TaskStore {
     const branch = key.ok ? key.data.branch : null;
     if (!branch || !location.ok)
       return success(null, null, null);
-    const common = path14.dirname(location.data.dir);
-    const heads = path14.join(common, "logs", "refs", "heads");
-    const headLog = location.data.git ? path14.join(location.data.git.gitDir, "logs", "HEAD") : "";
+    const common = path15.dirname(location.data.dir);
+    const heads = path15.join(common, "logs", "refs", "heads");
+    const headLog = location.data.git ? path15.join(location.data.git.gitDir, "logs", "HEAD") : "";
     const signatures = [
-      path14.join(heads, branch),
+      path15.join(heads, branch),
       headLog,
       heads,
-      path14.join(common, "packed-refs")
+      path15.join(common, "packed-refs")
     ].map((file) => fileSignature(file) ?? "-");
     const slot = `${location.data.dir}\x00${headLog}\x00${branch}`;
     let resolved = origins.get(slot);
@@ -13341,7 +13453,7 @@ class TaskStore {
           aliases.push(rename.from);
       const start = branchStart(location.data, branch, aliases);
       const slash = start?.indexOf("/") ?? -1;
-      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path14.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
+      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path15.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
       const name = start && (remote ? start.slice(slash + 1) : start);
       resolved = {
         signature: signatures.join("|"),
@@ -13579,13 +13691,13 @@ class TaskStore {
     if (!ready.ok)
       return ready;
     const dirs = this.paths();
-    const recovery = path14.join(this.root, ".workit", "recovery");
+    const recovery = path15.join(this.root, ".workit", "recovery");
     if (fs11.existsSync(recovery)) {
       let files = 0;
       let bytes = 0;
       try {
         for (const name of fs11.readdirSync(recovery)) {
-          const stat = fs11.lstatSync(path14.join(recovery, name));
+          const stat = fs11.lstatSync(path15.join(recovery, name));
           if (!stat.isFile())
             continue;
           files += 1;
@@ -13638,7 +13750,7 @@ class TaskStore {
       if (fs11.existsSync(dirs.blobs))
         for (const name of fs11.readdirSync(dirs.blobs)) {
           const digest = name.replace(/\.json$/, "");
-          const file = path14.join(dirs.blobs, name);
+          const file = path15.join(dirs.blobs, name);
           let stat;
           try {
             stat = fs11.lstatSync(file);
@@ -13656,7 +13768,7 @@ class TaskStore {
         }
       return success(null, null, null);
     };
-    const swept = dryRun ? sweep() : this.withLock(path14.join(dirs.dir, "gc.lock"), sweep);
+    const swept = dryRun ? sweep() : this.withLock(path15.join(dirs.dir, "gc.lock"), sweep);
     if (!swept.ok)
       return swept;
     const temporaryDirs = [
@@ -13664,7 +13776,7 @@ class TaskStore {
       dirs.tasks,
       dirs.blobs,
       dirs.checkout,
-      ...names.map((name) => path14.join(dirs.tasks, name))
+      ...names.map((name) => path15.join(dirs.tasks, name))
     ];
     for (const directory of temporaryDirs) {
       if (!fs11.existsSync(directory))
@@ -13672,7 +13784,7 @@ class TaskStore {
       for (const name of fs11.readdirSync(directory)) {
         if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
           continue;
-        const file = path14.join(directory, name);
+        const file = path15.join(directory, name);
         try {
           const stat = fs11.lstatSync(file);
           if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
@@ -13689,30 +13801,30 @@ class TaskStore {
   }
   paths() {
     const location = this.location();
-    const dir = location.ok ? location.data.dir : path14.join(this.root, ".workit");
-    const checkout = path14.join(dir, "checkouts", checkoutSlug(this.root));
+    const dir = location.ok ? location.data.dir : path15.join(this.root, ".workit");
+    const checkout = path15.join(dir, "checkouts", checkoutSlug(this.root));
     return {
       dir,
       shared: location.ok ? location.data.shared : false,
-      marker: path14.join(dir, "store.json"),
+      marker: path15.join(dir, "store.json"),
       checkout,
-      workspace: path14.join(checkout, "workspace.json"),
-      checkoutLock: path14.join(checkout, "metadata.lock"),
-      tasks: path14.join(dir, "tasks"),
-      index: path14.join(dir, "task-index.json"),
-      blobs: path14.join(dir, "blobs", "candidates"),
-      legacy: path14.join(dir, "legacy", checkoutSlug(this.root), "v2"),
-      v2: path14.join(this.root, ".workit")
+      workspace: path15.join(checkout, "workspace.json"),
+      checkoutLock: path15.join(checkout, "metadata.lock"),
+      tasks: path15.join(dir, "tasks"),
+      index: path15.join(dir, "task-index.json"),
+      blobs: path15.join(dir, "blobs", "candidates"),
+      legacy: path15.join(dir, "legacy", checkoutSlug(this.root), "v2"),
+      v2: path15.join(this.root, ".workit")
     };
   }
   eventsPath(taskId) {
-    return path14.join(this.paths().tasks, taskId, "events.jsonl");
+    return path15.join(this.paths().tasks, taskId, "events.jsonl");
   }
   snapshotPath(taskId) {
-    return path14.join(this.paths().tasks, taskId, "snapshot.json");
+    return path15.join(this.paths().tasks, taskId, "snapshot.json");
   }
   taskLockPath(taskId) {
-    return path14.join(this.paths().tasks, taskId, "lock");
+    return path15.join(this.paths().tasks, taskId, "lock");
   }
   ready(write = false) {
     const location = this.location();
@@ -13751,13 +13863,13 @@ class TaskStore {
     return {
       read: (digest) => {
         try {
-          return JSON.parse(fs11.readFileSync(path14.join(dir, `${digest}.json`), "utf8"));
+          return JSON.parse(fs11.readFileSync(path15.join(dir, `${digest}.json`), "utf8"));
         } catch (error) {
           throw new LogDamage(`stored candidate ${digest} is missing or unreadable: ${String(error)}`);
         }
       },
       write: (digest, value) => {
-        const file = path14.join(dir, `${digest}.json`);
+        const file = path15.join(dir, `${digest}.json`);
         if (fs11.existsSync(file)) {
           const stamp = new Date;
           try {
@@ -13949,7 +14061,7 @@ class TaskStore {
     }
   }
   openTask(record, type, key, legacy = null) {
-    const dir = path14.join(this.paths().tasks, record.id);
+    const dir = path15.join(this.paths().tasks, record.id);
     fs11.mkdirSync(dir, { recursive: true });
     const blobs = this.blobStore();
     const bound = key ? { ...key, boundAt: key.boundAt ?? new Date().toISOString() } : null;
@@ -14042,7 +14154,7 @@ class TaskStore {
   }
   withKeyLock(key, operation) {
     const digest = createHash9("sha256").update(key).digest("hex").slice(0, 32);
-    return this.withLock(path14.join(this.paths().dir, "keys", `${digest}.lock`), operation);
+    return this.withLock(path15.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
     const current = this.readWorkspace();
@@ -14183,7 +14295,7 @@ class TaskStore {
   writeWorkspace(record) {
     const file = this.paths().workspace;
     try {
-      fs11.mkdirSync(path14.dirname(file), { recursive: true });
+      fs11.mkdirSync(path15.dirname(file), { recursive: true });
       replaceFile(file, `${canonicalJson(record)}
 `, true);
       return success(null, null, null);
@@ -14261,23 +14373,23 @@ class TaskStore {
     return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
   }
   v2Dirs() {
-    return [...new Set([this.root, this.origin])].map((dir) => path14.join(dir, ".workit"));
+    return [...new Set([this.root, this.origin])].map((dir) => path15.join(dir, ".workit"));
   }
   pendingMigrations() {
     return this.v2Dirs().filter((dir) => {
-      const raw = this.readV2Workspace(path14.join(dir, "workspace.json"));
+      const raw = this.readV2Workspace(path15.join(dir, "workspace.json"));
       return raw !== null && raw !== TOMBSTONE;
     });
   }
   migrateV2(v2) {
     const dirs = this.paths();
-    const v2Workspace = path14.join(v2, "workspace.json");
-    const v2Tasks = path14.join(v2, "tasks");
-    const legacy = path14.join(dirs.dir, "legacy", checkoutSlug(path14.dirname(v2)), "v2");
+    const v2Workspace = path15.join(v2, "workspace.json");
+    const v2Tasks = path15.join(v2, "tasks");
+    const legacy = path15.join(dirs.dir, "legacy", checkoutSlug(path15.dirname(v2)), "v2");
     const raw = this.readV2Workspace(v2Workspace);
     if (raw === null || raw === TOMBSTONE)
       return success(null, null, null);
-    return this.withLock(dirs.checkoutLock, () => this.withLock(path14.join(v2, "metadata.lock"), () => {
+    return this.withLock(dirs.checkoutLock, () => this.withLock(path15.join(v2, "metadata.lock"), () => {
       const workspace = this.readV2Workspace(v2Workspace);
       if (workspace === null || workspace === TOMBSTONE)
         return success(null, null, null);
@@ -14286,7 +14398,7 @@ class TaskStore {
         return failure2("recovery_required", `cannot migrate the 2.x store at ${v2}: ${parsedWorkspace.error}; move it aside to start fresh`, { path: v2Workspace });
       let files = [];
       try {
-        files = fs11.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path14.join(v2Tasks, name)));
+        files = fs11.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path15.join(v2Tasks, name)));
       } catch {}
       const current = this.readWorkspace();
       if (!current.ok)
@@ -14304,21 +14416,21 @@ class TaskStore {
       let skipped = 0;
       const done = new Map;
       try {
-        fs11.mkdirSync(path14.join(legacy, "tasks"), { recursive: true });
+        fs11.mkdirSync(path15.join(legacy, "tasks"), { recursive: true });
         for (const name of ["workspace.json", "index.json"])
-          if (fs11.existsSync(path14.join(v2, name)))
-            fs11.copyFileSync(path14.join(v2, name), path14.join(legacy, name));
+          if (fs11.existsSync(path15.join(v2, name)))
+            fs11.copyFileSync(path15.join(v2, name), path15.join(legacy, name));
         for (const name of files) {
           const id = name.slice(0, -5);
-          const file = path14.join(v2Tasks, name);
+          const file = path15.join(v2Tasks, name);
           const bytes = fs11.readFileSync(file, "utf8");
           const digest = sha256(bytes);
-          fs11.writeFileSync(path14.join(legacy, "tasks", name), bytes);
+          fs11.writeFileSync(path15.join(legacy, "tasks", name), bytes);
           const parsed = this.parseRecord(bytes, taskRecordSchema, "2.x task");
           if (!parsed.ok || parsed.data.id !== id)
             return failure2("recovery_required", `cannot migrate 2.x task ${id}: ${parsed.ok ? "file name and record ID differ" : parsed.error}; move ${file} aside to continue`, { path: file });
           const record = { ...parsed.data, workspaceId: target.id };
-          const origin = { path: path14.join(legacy, "tasks", name), digest };
+          const origin = { path: path15.join(legacy, "tasks", name), digest };
           if (!fs11.existsSync(this.eventsPath(id))) {
             this.openTask(record, "migrated.from_v2", null, origin);
             migrated += 1;
@@ -14354,7 +14466,7 @@ class TaskStore {
       try {
         let complete = true;
         for (const [name, digest] of done) {
-          const file = path14.join(v2Tasks, name);
+          const file = path15.join(v2Tasks, name);
           if (sha256(fs11.readFileSync(file, "utf8")) !== digest) {
             complete = false;
             continue;
@@ -14365,7 +14477,7 @@ class TaskStore {
           return failure2("busy", `the 2.x store at ${v2} changed during migration; retry`, {
             path: v2
           });
-        fs11.rmSync(path14.join(v2, "index.json"), { force: true });
+        fs11.rmSync(path15.join(v2, "index.json"), { force: true });
         this.writeTombstone(v2, target.id);
       } catch (error) {
         return failure2("storage_error", `cannot finish the 2.x migration: ${String(error)}`, {
@@ -14385,7 +14497,7 @@ class TaskStore {
   }
   adoptLocalStore() {
     const dirs = this.paths();
-    const marker = path14.join(dirs.v2, "store.json");
+    const marker = path15.join(dirs.v2, "store.json");
     if (!dirs.shared || !fs11.existsSync(marker))
       return success(null, null, null);
     return this.withLock(dirs.checkoutLock, () => {
@@ -14395,7 +14507,7 @@ class TaskStore {
       try {
         const merge = (from, to) => {
           if (!fs11.existsSync(to)) {
-            fs11.mkdirSync(path14.dirname(to), { recursive: true });
+            fs11.mkdirSync(path15.dirname(to), { recursive: true });
             try {
               fs11.renameSync(from, to);
             } catch {
@@ -14406,24 +14518,24 @@ class TaskStore {
           }
           if (fs11.lstatSync(from).isDirectory() && fs11.lstatSync(to).isDirectory())
             for (const name of fs11.readdirSync(from))
-              merge(path14.join(from, name), path14.join(to, name));
+              merge(path15.join(from, name), path15.join(to, name));
         };
         for (const sub of ["tasks", "checkouts", "blobs", "legacy"]) {
-          const from = path14.join(dirs.v2, sub);
+          const from = path15.join(dirs.v2, sub);
           if (!fs11.existsSync(from))
             continue;
           if (sub === "tasks") {
             for (const name of fs11.readdirSync(from))
-              if (validId(name) && !fs11.existsSync(path14.join(dirs.dir, sub, name)))
+              if (validId(name) && !fs11.existsSync(path15.join(dirs.dir, sub, name)))
                 tasks += 1;
           }
-          merge(from, path14.join(dirs.dir, sub));
+          merge(from, path15.join(dirs.dir, sub));
         }
-        const ledger = path14.join(dirs.v2, "ledger");
-        if (fs11.existsSync(ledger) && !fs11.existsSync(path14.join(dirs.dir, "ledger")))
-          merge(ledger, path14.join(dirs.dir, "ledger"));
-        fs11.rmSync(path14.join(dirs.v2, "task-index.json"), { force: true });
-        fs11.renameSync(marker, path14.join(dirs.v2, "store.moved.json"));
+        const ledger = path15.join(dirs.v2, "ledger");
+        if (fs11.existsSync(ledger) && !fs11.existsSync(path15.join(dirs.dir, "ledger")))
+          merge(ledger, path15.join(dirs.dir, "ledger"));
+        fs11.rmSync(path15.join(dirs.v2, "task-index.json"), { force: true });
+        fs11.renameSync(marker, path15.join(dirs.v2, "store.moved.json"));
       } catch (error) {
         return failure2("storage_error", `cannot move ${dirs.v2} into ${dirs.dir}: ${String(error)}`, {
           path: dirs.v2
@@ -14461,7 +14573,7 @@ class TaskStore {
       schemaVersion: SCHEMA_VERSION,
       id: workspaceId ?? newId(),
       revision: newRevision(),
-      root: path14.dirname(v2),
+      root: path15.dirname(v2),
       runtime: { createdWith: version, updatedWith: version },
       writer: null,
       store: {
@@ -14473,11 +14585,11 @@ class TaskStore {
       critical: ["store"]
     };
     fs11.mkdirSync(v2, { recursive: true });
-    const ignore = path14.join(v2, ".gitignore");
+    const ignore = path15.join(v2, ".gitignore");
     if (!fs11.existsSync(ignore))
       fs11.writeFileSync(ignore, `*
 `);
-    replaceFile(path14.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
+    replaceFile(path15.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
 `, true);
   }
   stubFor(taskId) {
@@ -14501,8 +14613,8 @@ class TaskStore {
   }
   writeTombstoneIfMissing() {
     try {
-      const v2 = path14.join(this.root, ".workit");
-      if (fs11.existsSync(path14.join(v2, "workspace.json")))
+      const v2 = path15.join(this.root, ".workit");
+      if (fs11.existsSync(path15.join(v2, "workspace.json")))
         return;
       let id = null;
       try {
@@ -14519,7 +14631,7 @@ class TaskStore {
       replaceFile(dirs.marker, `${JSON.stringify({ format: "workit-store", version: STORE_FORMAT, createdWith: runtimeVersion() })}
 `, false);
     if (!dirs.shared) {
-      const ignore = path14.join(dirs.dir, ".gitignore");
+      const ignore = path15.join(dirs.dir, ".gitignore");
       let current = null;
       try {
         current = fs11.readFileSync(ignore, "utf8");
@@ -14579,7 +14691,7 @@ class TaskStore {
   withLock(lockPath, operation) {
     try {
       this.initializeStorage();
-      fs11.mkdirSync(path14.dirname(lockPath), { recursive: true });
+      fs11.mkdirSync(path15.dirname(lockPath), { recursive: true });
     } catch (error) {
       return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.paths().dir
@@ -14642,7 +14754,7 @@ class TaskStore {
     if (isTransientWindowsError(error) && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
       return failure2("storage_error", `cannot create the workit lock (${code}); no other Workit call holds it`, {
         path: lockPath,
-        guidance: `Check permissions and the read-only attribute on ${path14.dirname(lockPath)}.`
+        guidance: `Check permissions and the read-only attribute on ${path15.dirname(lockPath)}.`
       });
     if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
       let lock = null;
@@ -14669,12 +14781,12 @@ var workerBlocksTransition = (transition, state) => transition === "pause" ? fal
 import { createHash as createHash10 } from "node:crypto";
 import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
 import fs12 from "node:fs";
-import path15 from "node:path";
+import path16 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
 var CHECKS_FILE = "workit.checks.json";
 var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -14727,10 +14839,10 @@ var git4 = (cwd, args) => {
   return value || null;
 };
 function checkRoot(cwd) {
-  return path15.resolve(git4(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+  return path16.resolve(git4(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
 }
 var packageManager = (root) => {
-  const has = (file) => fs12.existsSync(path15.join(root, file));
+  const has = (file) => fs12.existsSync(path16.join(root, file));
   if (has("bun.lock") || has("bun.lockb"))
     return "bun";
   if (has("pnpm-lock.yaml"))
@@ -14750,7 +14862,7 @@ var CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
 function detectedChecks(root) {
   const read = (file) => {
     try {
-      return fs12.readFileSync(path15.join(root, file), "utf8");
+      return fs12.readFileSync(path16.join(root, file), "utf8");
     } catch {
       return null;
     }
@@ -14789,7 +14901,7 @@ function detectedChecks(root) {
 var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
-  const file = path15.join(root, CHECKS_FILE);
+  const file = path16.join(root, CHECKS_FILE);
   const none = (error = null) => ({
     source: error ? CHECKS_FILE : "none",
     root,
@@ -14838,7 +14950,7 @@ function loadCheckConfig(cwd) {
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null };
+  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
 }
 var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
 function matchesNamedCheck(config, name, argv, cwd) {
@@ -14862,10 +14974,10 @@ function workitAvailable(env = process.env) {
     return workitOnPath;
   const windows = process.platform === "win32";
   const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  const dirs = (env.PATH ?? env.Path ?? "").split(path15.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path16.delimiter).filter(Boolean);
   workitOnPath = dirs.some((dir) => exts.some((ext) => {
     try {
-      return fs12.statSync(path15.join(dir, `workit${ext}`)).isFile();
+      return fs12.statSync(path16.join(dir, `workit${ext}`)).isFile();
     } catch {
       return false;
     }
@@ -14878,14 +14990,14 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 
 // packages/workit-core/src/core/task-evaluation.ts
 var digestBytes = (value) => createHash10("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path16.sep}`);
-var relative = (root, candidate) => path16.relative(root, candidate).split(path16.sep).join("/") || ".";
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`);
+var relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path16.posix.normalize(value);
+  const normalized = path17.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -14933,14 +15045,14 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
@@ -14955,7 +15067,7 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path16.join(directory, name);
+    const target = path17.join(directory, name);
     let stat;
     try {
       stat = fs13.lstatSync(target);
@@ -14973,12 +15085,12 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path16.resolve(root, item);
+    const target = path17.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
     while (!fs13.existsSync(ancestor) && ancestor !== root)
-      ancestor = path16.dirname(ancestor);
+      ancestor = path17.dirname(ancestor);
     try {
       if (!inside(root, fs13.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
@@ -15030,7 +15142,7 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path16.join(checkout, item);
+    const target = path17.join(checkout, item);
     try {
       const stat = fs13.lstatSync(target);
       if (stat.isSymbolicLink()) {
@@ -15214,23 +15326,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path16.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path16.sep}`))
+    const target = path17.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path17.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path16.relative(root, target);
+      const below = path17.relative(root, target);
       let current = root;
-      for (const segment of below.split(path16.sep)) {
+      for (const segment of below.split(path17.sep)) {
         if (!segment)
           continue;
-        current = path16.join(current, segment);
+        current = path17.join(current, segment);
         const stat = fs13.lstatSync(current);
         const real = fs13.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path16.sep}`))
+        if (real !== root && !real.startsWith(`${root}${path17.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -15605,9 +15717,9 @@ Autonomy contract:
   ship), go to the effective endpoint in \`workit grant show\`: \`pr\` opens
   the PR; \`green\` babysits it without asking (workit-ship) to merge-ready,
   never merging; \`merged\` also lands it with \`workit pr merge\`.
-  Merge and release need a workspace grant, which only the user raises from
-  their own terminal (a blocked verb names how); never edit workspaces.json or
-  route around a grant_required.
+  Merge and release need a workspace grant only the user raises from their
+  own terminal (a blocked verb names how); never edit workspaces.json or route
+  around a grant_required.
 - Ask only for a product or preference choice, or for authority you lack, with
   your recommended answer. Facts are yours: read, run or prototype.
 - Label claims measured (run and seen this session), inferred, or guess.
@@ -15616,17 +15728,19 @@ Autonomy contract:
 - Author is not verifier: your own verdict is \`--self\`, shown as
   self-reviewed, never verified. High risk, \`verification: independent\` and
   merge need a verifier with its own host-derived session (a subagent's
-  \`<lead>:<child>\`, set by the host); never hand-mint one such as \`<lead>-v1\`.
+  \`<lead>:<child>\`); never hand-mint one (\`<lead>-v1\`).
 - A local-commit endpoint does not imply PR readiness, and a local commit alone
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
 
 CLI first: if a step has one right answer, use the \`workit\` verb instead of
 hand-running git, gh or glab (\`workit git|pr|ci|check\`; \`workit help\` lists
-the rest; without \`workit\` on PATH, \`npx -y @brainervirus/workit-cli\`).
+the rest; lacking \`workit\`, \`npx -y @brainervirus/workit-cli\`).
+Add Co-Authored-By via \`workit git commit --trailer "K: v" -- <paths>\`, never
+an amend.
 The task families (task, policy, evidence, finding, decision, worker, state)
 are optional continuity for tracked work; each branch has one implicit task,
-created by the first recording, and a solo edit needs no task. A decision
+and a solo edit needs no task. A decision
 records a user choice; it never authorizes an effect. Judge work once with
 \`workit policy assess --judge risk= behavior= product-choice= plan=\`.
 Across repositories, bind each item to its checkout, branch and endpoint,
@@ -17446,7 +17560,7 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
 // packages/workit-core/src/hooks/context.ts
 import { createHash as createHash11 } from "node:crypto";
 import fs14 from "node:fs";
-import path17 from "node:path";
+import path18 from "node:path";
 var MIGRATION_PENDING_NOTE = "workit migration pending — run `workit task status`";
 var migrationPending = (result) => !result.ok && result.code === "needs_input" && (result.error ?? "").startsWith(MIGRATION_PENDING);
 var boundTo = (entry, session) => entry.sessions.some((item) => item.host === session.host && item.handle === session.handle);
@@ -17531,7 +17645,7 @@ function entryCompactContext(store, entry, session, context) {
     return null;
   const freshness = { mode: "signal", current: () => recentSignal(store.root) };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
-  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path17.resolve(store.root, ref.path)] : []));
+  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path18.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
   const compact = new WorkitCore(store, context).compactContext(entry?.id ?? null, freshness, origin && { origin: origin.origin, taskId: origin.entry.id });
   if (!compact.ok || !compact.data)
@@ -17609,14 +17723,14 @@ var turnMarker = (input) => {
     if (location instanceof Error)
       return null;
     const session = [input.host, input.session.id, input.session.agentId ?? ""].join("\x00");
-    return path17.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
+    return path18.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
   } catch {
     return null;
   }
 };
 var writeTurnDigest = (file, digest) => {
   try {
-    fs14.mkdirSync(path17.dirname(file), { recursive: true });
+    fs14.mkdirSync(path18.dirname(file), { recursive: true });
     fs14.writeFileSync(file, `${JSON.stringify({ digest })}
 `);
   } catch {}
@@ -17631,7 +17745,7 @@ var pruneTurnDigests = (dir, now) => {
     for (const name of fs14.readdirSync(dir)) {
       if (!name.startsWith("turn-"))
         continue;
-      const file = path17.join(dir, name);
+      const file = path18.join(dir, name);
       try {
         if (now - fs14.statSync(file).mtimeMs > TURN_TTL_MS)
           fs14.rmSync(file, { force: true });
@@ -17661,7 +17775,7 @@ var seedTurnContext = (input, descriptor, text = turnContextText(input, descript
   const file = turnMarker(input);
   if (!file)
     return;
-  pruneTurnDigests(path17.dirname(file), Date.now());
+  pruneTurnDigests(path18.dirname(file), Date.now());
   if (text)
     writeTurnDigest(file, digestOf(text));
   else
@@ -17670,14 +17784,14 @@ var seedTurnContext = (input, descriptor, text = turnContextText(input, descript
 // packages/workit-core/src/core/route-intent.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
 import { existsSync as existsSync6 } from "node:fs";
-import path20 from "node:path";
+import path21 from "node:path";
 
 // packages/workit-core/src/hooks/raw-git.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import fs16 from "node:fs";
-import os4 from "node:os";
-import path19 from "node:path";
+import os5 from "node:os";
+import path20 from "node:path";
 
 // packages/workit-core/src/core/branch.ts
 import { createHash as createHash12 } from "node:crypto";
@@ -17890,7 +18004,7 @@ var globOf = (pattern) => pattern.source.replace(/^\^|\$$/gu, "").replaceAll(".*
 // packages/workit-core/src/hooks/session-marker.ts
 import { createHash as createHash13 } from "node:crypto";
 import fs15 from "node:fs";
-import path18 from "node:path";
+import path19 from "node:path";
 var sessionMarkerFile = (input, session, store) => {
   let dir = store;
   if (dir === undefined) {
@@ -17900,7 +18014,7 @@ var sessionMarkerFile = (input, session, store) => {
     dir = location.dir;
   }
   const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
-  return path18.join(dir, "hooks", `skills-${name}.json`);
+  return path19.join(dir, "hooks", `skills-${name}.json`);
 };
 var list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 var readSessionMarker = (file) => {
@@ -17913,7 +18027,7 @@ var readSessionMarker = (file) => {
 };
 var writeSessionMarker = (file, marker) => {
   try {
-    fs15.mkdirSync(path18.dirname(file), { recursive: true });
+    fs15.mkdirSync(path19.dirname(file), { recursive: true });
     fs15.writeFileSync(file, JSON.stringify(marker));
   } catch {}
 };
@@ -18058,12 +18172,12 @@ var GIT_VALUE_OPTIONS = new Set([
   "--config-env",
   "--super-prefix"
 ]);
-var isAbsolute = (value) => path19.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
+var isAbsolute = (value) => path20.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
 var joinDir = (base, next) => {
   if (base === undefined || /[$`*?]/.test(next) || next === "-")
     return;
-  const expanded = next === "~" || next.startsWith("~/") ? path19.join(os4.homedir(), next.slice(1)) : next;
-  return base === null || isAbsolute(expanded) ? expanded : path19.join(base, expanded);
+  const expanded = next === "~" || next.startsWith("~/") ? path20.join(os5.homedir(), next.slice(1)) : next;
+  return base === null || isAbsolute(expanded) ? expanded : path20.join(base, expanded);
 };
 var cdTarget = (words) => {
   const args = words.slice(1);
@@ -18114,7 +18228,7 @@ function rawInvocations(command, dialect = "posix", depth = 0) {
     const name = commandName(words[0]);
     if (CD.has(name)) {
       const target = cdTarget(words);
-      dir = target === null ? os4.homedir() : joinDir(dir, target);
+      dir = target === null ? os5.homedir() : joinDir(dir, target);
       continue;
     }
     if (PUSHD.has(name)) {
@@ -18372,17 +18486,17 @@ var headSha2 = (repo) => {
   if (!git || git.reftable)
     return null;
   try {
-    const head = fs16.readFileSync(path19.join(git.gitDir, "HEAD"), "utf8").trim();
+    const head = fs16.readFileSync(path20.join(git.gitDir, "HEAD"), "utf8").trim();
     if (/^[0-9a-f]{40,64}$/.test(head))
       return head;
     const ref = /^ref: (refs\/.+)$/.exec(head)?.[1];
     if (!ref)
       return null;
-    const common = path19.dirname(repo.location.dir);
+    const common = path20.dirname(repo.location.dir);
     try {
-      return fs16.readFileSync(path19.join(common, ref), "utf8").trim() || null;
+      return fs16.readFileSync(path20.join(common, ref), "utf8").trim() || null;
     } catch {}
-    const packed = fs16.readFileSync(path19.join(common, "packed-refs"), "utf8");
+    const packed = fs16.readFileSync(path20.join(common, "packed-refs"), "utf8");
     return new RegExp(`^([0-9a-f]{40,64}) ${ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m").exec(packed)?.[1] ?? null;
   } catch {
     return null;
@@ -18471,7 +18585,7 @@ var actionsIn = (cwd, command, dialect) => {
     const action = rawAction(invocation);
     if (!action)
       continue;
-    const dir = path19.resolve(cwd, invocation.dir ?? ".");
+    const dir = path20.resolve(cwd, invocation.dir ?? ".");
     if (!repos.has(dir)) {
       const repo = repoAt(dir);
       repos.set(dir, repo && isWorkitWorkspace(repo) ? repo : null);
@@ -18551,7 +18665,7 @@ function rawGitPre(input, command, options = {}) {
 var deny = (reason) => ({ kind: "deny", reason, unblock: null });
 var NEXT_COMMAND = "next";
 var MARKER_TTL_SECONDS = 3600;
-var markerFile = (repo, session, key) => path19.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
+var markerFile = (repo, session, key) => path20.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
 var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash14("sha256").update(command).digest("hex")}`;
 function noteRawCommit(input, command, key) {
   try {
@@ -18562,7 +18676,7 @@ function noteRawCommit(input, command, key) {
       if (action.kind !== "commit")
         continue;
       const file = markerFile(repo, input.session.id, key);
-      fs16.mkdirSync(path19.dirname(file), { recursive: true });
+      fs16.mkdirSync(path20.dirname(file), { recursive: true });
       fs16.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
 `);
     }
@@ -18735,7 +18849,7 @@ var shellBranchPolicyViolation = (root, command, dialect = "posix") => {
   for (const target of shellBranchTargets(command, dialect)) {
     if (target.dir === undefined)
       continue;
-    const dir = target.dir === null ? root : path20.resolve(root, target.dir);
+    const dir = target.dir === null ? root : path21.resolve(root, target.dir);
     if (target.dir !== null && (!existsSync6(dir) || !inWorkitWorkspace(dir)))
       continue;
     if (localBranchExists(dir, target.branch))
@@ -18755,27 +18869,27 @@ var shellPolicy = (cwd, command, dialect = "posix") => {
 };
 // packages/workit-core/src/hooks/write-gate.ts
 import { realpathSync as realpathSync5 } from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 var NONE3 = { kind: "none" };
 var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
 var canonical2 = (file) => {
   let rest = "";
-  for (let dir = path21.resolve(file);; dir = path21.dirname(dir)) {
+  for (let dir = path22.resolve(file);; dir = path22.dirname(dir)) {
     try {
-      return path21.join(realpathSync5(dir), rest);
+      return path22.join(realpathSync5(dir), rest);
     } catch {
-      if (path21.dirname(dir) === dir)
-        return path21.resolve(file);
-      rest = rest ? path21.join(path21.basename(dir), rest) : path21.basename(dir);
+      if (path22.dirname(dir) === dir)
+        return path22.resolve(file);
+      rest = rest ? path22.join(path22.basename(dir), rest) : path22.basename(dir);
     }
   }
 };
 var exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path21.relative(fold(canonical2(root)), fold(canonical2(path21.resolve(cwd, file))));
-  if (relative.startsWith("..") || path21.isAbsolute(relative))
+  const relative = path22.relative(fold(canonical2(root)), fold(canonical2(path22.resolve(cwd, file))));
+  if (relative.startsWith("..") || path22.isAbsolute(relative))
     return true;
-  const posix = relative.split(path21.sep).join("/");
+  const posix = relative.split(path22.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
@@ -18873,7 +18987,7 @@ var shellWrites = (command) => {
   return { writes: true, targets: unknown ? null : targets };
 };
 var cache2 = new Map;
-var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path21.resolve(root, file)) ?? "-").join("\x00");
+var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path22.resolve(root, file)) ?? "-").join("\x00");
 var gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
@@ -19314,12 +19428,12 @@ ${line}` };
 };
 // packages/workit-core/src/hooks/hosts/fields.ts
 import { existsSync as existsSync7, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 var isRecord4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path22.isAbsolute(value) || !existsSync7(value))
+  if (!nonEmpty2(value) || !path23.isAbsolute(value) || !existsSync7(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -19402,7 +19516,7 @@ var workitRole = (descriptor, agentType) => {
 };
 var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
 var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
-var ISOLATED_GIT = 'Run git as plain, separate commands inside your worktree (`git switch -c <branch> <base>`, `git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a commit-msg hook that adds the trailer), never `workit git …`: Claude Code\'s worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (`workit check`, `workit ledger`, `workit pr`).';
+var isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
 var subagentStartText = (input, descriptor, event) => {
   const session = input.session.id ?? null;
   const role = workitRole(descriptor, event.agentType);
@@ -19410,9 +19524,9 @@ var subagentStartText = (input, descriptor, event) => {
   const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
-    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${ISOLATED_GIT} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
-    return `${ISOLATED_GIT}
+    return `${isolatedGit(input.cwd)}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
     return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
@@ -20058,7 +20172,7 @@ var codexAdapter = {
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
 import fs17 from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 var undocumented = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
@@ -20255,7 +20369,7 @@ var protocolEvent2 = (input) => {
 };
 var TRANSCRIPT_TAIL_BYTES = 256 * 1024;
 var lastAssistantText = (file) => {
-  if (!file || !path23.isAbsolute(file))
+  if (!file || !path24.isAbsolute(file))
     return null;
   try {
     const size = fs17.statSync(file).size;
@@ -20292,7 +20406,7 @@ var lastAssistantText = (file) => {
     return null;
   }
 };
-var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path23.sep) ? root : `${root}${path23.sep}`);
+var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path24.sep) ? root : `${root}${path24.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")