@brainervirus/workit-cursor 8.12.3 → 8.13.1

package/dist/cursor-session-start.js

@@ -8638,1557 +8638,1697 @@ var init_rev = __esm(() => {
   MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
 });
 
-// packages/workit-core/src/core/boundary.ts
-var EVENT, errorDetail = (err) => {
-  if (err instanceof Error) {
-    return { error_name: err.name, error: err.message };
-  }
-  return { error_name: "unknown", error: String(err) };
-};
-var init_boundary = __esm(() => {
-  EVENT = {
-    initialization: "initialization",
-    provenance: "provenance",
-    assets: "assets",
-    configurationSource: "configuration_source",
-    hooks: "hooks",
-    mcpConnection: "mcp_connection",
-    migration: "migration",
-    installSteps: "install_steps",
-    uncaughtFailure: "uncaught_failure",
-    toolsFailed: "tools_failed",
-    doctor: "doctor"
-  };
-});
-
-// packages/workit-core/src/core/config.ts
-import {
-  copyFileSync,
-  cpSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  readdirSync,
-  writeFileSync
-} from "node:fs";
-import os2 from "node:os";
+// packages/workit-core/src/store/paths.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
+import fs2 from "node:fs";
 import path2 from "node:path";
-var diagnosticLogger, PRESETS, mergePreset = (preset, input = {}, current = {
-  branchPolicy: { preset, allowed: [], protected: [] }
-}) => {
-  const defs = PRESETS[preset];
-  return {
-    preset,
-    allowed: preset === "custom" ? input.allowed ?? current.branchPolicy.allowed : [...defs.allowed],
-    protected: preset === "custom" ? input.protectedNames ?? current.branchPolicy.protected : [...defs.protected]
-  };
-}, resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path2.join(process.env.XDG_CONFIG_HOME || path2.join(os2.homedir(), ".config"), "workit"), migratedDir = null, migrationFailed = false, ensureConfigDir = (dir = resolveConfigDir()) => {
-  if (migratedDir === dir)
-    return dir;
-  if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
-    migratedDir = dir;
-    return dir;
-  }
-  const legacy = path2.join(process.env.XDG_CONFIG_HOME || path2.join(os2.homedir(), ".config"), "workflow-toolkit");
-  if (!existsSync(legacy)) {
-    migratedDir = dir;
-    return dir;
+function fastGit(root) {
+  if (DISCOVERY_ENV.some((name) => process.env[name]))
+    return null;
+  let dir = real(root);
+  let device = null;
+  for (;; ) {
+    let stat;
+    try {
+      stat = fs2.statSync(dir);
+    } catch {
+      return null;
+    }
+    if (device !== null && stat.dev !== device)
+      return { kind: "none" };
+    device = stat.dev;
+    const dotGit = path2.join(dir, ".git");
+    let entry = null;
+    try {
+      entry = fs2.statSync(dotGit);
+    } catch {}
+    let gitDir = null;
+    let top = null;
+    if (entry) {
+      top = dir;
+      if (entry.isDirectory())
+        gitDir = dotGit;
+      else if (entry.isFile()) {
+        let text = "";
+        try {
+          text = fs2.readFileSync(dotGit, "utf8");
+        } catch {
+          return null;
+        }
+        const match = /^gitdir: (.+)$/mu.exec(text);
+        if (!match)
+          return null;
+        gitDir = path2.resolve(dir, match[1].trim());
+      } else
+        return null;
+      if (!fs2.existsSync(path2.join(gitDir, "HEAD")))
+        return null;
+    } else if (isGitDir(dir))
+      gitDir = dir;
+    if (gitDir) {
+      let common = gitDir;
+      try {
+        common = path2.resolve(gitDir, fs2.readFileSync(path2.join(gitDir, "commondir"), "utf8").trim());
+      } catch {}
+      if (!fs2.existsSync(path2.join(common, "objects")))
+        return null;
+      return {
+        kind: "repo",
+        common: real(common),
+        gitDir: real(gitDir),
+        top: top === null ? null : real(top),
+        reftable: reftableRefs(common)
+      };
+    }
+    const parent = path2.dirname(dir);
+    if (parent === dir)
+      return { kind: "none" };
+    dir = parent;
   }
-  if (!migrationFailed && existsSync(dir)) {
-    migratedDir = dir;
-    return dir;
+}
+function resolveStore(root) {
+  root = path2.resolve(root);
+  let directory = false;
+  try {
+    directory = fs2.statSync(root).isDirectory();
+  } catch {}
+  if (!directory)
+    return { dir: path2.join(root, ".workit"), shared: false, top: null };
+  const fast = fastGit(root);
+  if (fast?.kind === "none")
+    return { dir: path2.join(root, ".workit"), shared: false, top: null };
+  if (fast?.kind === "repo")
+    return {
+      dir: path2.join(fast.common, "workit"),
+      shared: true,
+      top: fast.top,
+      git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
+    };
+  const run = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  const common = run.stdout.trim();
+  if (run.ok && common) {
+    const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
+    return {
+      dir: path2.join(real(path2.resolve(root, common)), "workit"),
+      shared: true,
+      top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
+    };
   }
-  migrationFailed = false;
-  mkdirSync(dir, { recursive: true });
-  diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
-  for (const entry of readdirSync(legacy, { withFileTypes: true })) {
-    const src = path2.join(legacy, entry.name);
-    const dest = path2.join(dir, entry.name);
-    if (existsSync(dest))
-      continue;
+  if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
+    return { dir: path2.join(root, ".workit"), shared: false, top: null };
+  return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
+`)[0] || "no output"}); fix the repository (git status should work here)`);
+}
+function resolveTaskKey(root, location) {
+  if (!location.shared)
+    return { key: `dir-${shortHash(root)}`, kind: "dir", branch: null };
+  const branchKey = (name) => ({ key: name, kind: "branch", branch: name });
+  if (location.git && !location.git.reftable) {
+    let head = "";
     try {
-      if (entry.isDirectory())
-        cpSync(src, dest, { recursive: true });
-      else if (entry.isFile())
-        copyFileSync(src, dest);
-    } catch (err) {
-      migrationFailed = true;
-      diagnosticLogger?.warn(EVENT.migration, { from: src, ok: false, ...errorDetail(err) });
-      console.warn(`[workit] config migration: a file could not be copied to ${dir}; it will be retried on the next run`);
+      head = fs2.readFileSync(path2.join(location.git.gitDir, "HEAD"), "utf8").trim();
+    } catch {}
+    const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
+    if (ref && ref[1] !== ".invalid")
+      return branchKey(ref[1]);
+    if (/^[0-9a-f]{40,64}$/u.test(head)) {
+      const rebasing = rebasingBranch(location.git.gitDir);
+      if (rebasing)
+        return branchKey(rebasing);
+      return {
+        key: `detached-${shortHash(location.git.top ?? location.git.gitDir)}`,
+        kind: "detached",
+        branch: null
+      };
     }
   }
-  if (!migrationFailed)
-    migratedDir = dir;
-  return dir;
-}, configDir = () => ensureConfigDir(), LOCALE_RE, DEFAULTS, unchosenBranchPolicy, readSafe = (p) => {
+  const branch = gitRun(root, ["symbolic-ref", "-q", "--short", "HEAD"]);
+  const name = branch.ok ? branch.stdout.trim() : "";
+  if (name && name !== ".invalid")
+    return branchKey(name);
+  const gitDir = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-dir"]);
+  if (gitDir.ok && gitDir.stdout.trim()) {
+    const rebasing = rebasingBranch(gitDir.stdout.trim());
+    if (rebasing)
+      return branchKey(rebasing);
+  }
+  const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
+  const worktree = top.ok && top.stdout.trim() ? top.stdout.trim() : root;
+  return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
+}
+function checkoutRootOf(root, location) {
+  const resolved = path2.resolve(root);
+  let canonical = resolved;
   try {
-    return readFileSync(p, "utf8");
+    canonical = fs2.realpathSync(resolved);
   } catch {
-    return null;
+    return resolved;
   }
-}, isConfigObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value), parseConfigResult = (raw, file) => {
-  if (raw === null)
-    return { status: "missing", path: file };
-  let parsed;
+  const found = location ?? resolveStore(canonical);
+  if (found instanceof Error || !found.shared || !found.top)
+    return canonical;
+  if (real(canonical) === found.top)
+    return canonical;
   try {
-    parsed = JSON.parse(raw);
+    return fs2.realpathSync(found.top);
   } catch {
-    return { status: "malformed", path: file, error: `${file} is not valid JSON` };
-  }
-  if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, error: `${file} is not a JSON object` };
+    return canonical;
   }
-  const input = parsed;
-  const locale = LOCALE_RE.test(String(input.locale ?? "")) ? input.locale : DEFAULTS.locale;
-  const preset = Object.hasOwn(PRESETS, input.branchPolicy?.preset) ? input.branchPolicy?.preset : "gitflow";
-  const commitPreset = COMMIT_PRESETS.includes(String(input.commitPolicy?.preset ?? "")) ? input.commitPolicy?.preset : "conventional";
-  const config = {
-    locale,
-    localeOptions: Array.isArray(input.localeOptions) ? input.localeOptions : DEFAULTS.localeOptions,
-    branchPolicy: mergePreset(preset, {
-      allowed: Array.isArray(input.branchPolicy?.allowed) ? input.branchPolicy.allowed : undefined,
-      protectedNames: Array.isArray(input.branchPolicy?.protected) ? input.branchPolicy.protected : undefined
-    }, DEFAULTS),
-    commitPolicy: {
-      preset: commitPreset,
-      ...typeof input.commitPolicy?.pattern === "string" ? { pattern: input.commitPolicy.pattern } : {}
+}
+function branchRenames(location) {
+  if (!location.shared)
+    return [];
+  const files = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = fs2.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
     }
+    for (const entry of entries)
+      if (entry.isDirectory())
+        walk(path2.join(dir, entry.name));
+      else
+        files.push(path2.join(dir, entry.name));
   };
-  if (!Object.hasOwn(PRESETS, input.branchPolicy?.preset))
-    unchosenBranchPolicy.add(config);
-  return { status: "valid", path: file, config };
-}, readConfigTyped = (dir) => {
-  const file = path2.join(dir ?? configDir(), "config.json");
-  return parseConfigResult(readSafe(file), file);
-}, readConfig = () => {
-  const result = readConfigTyped();
-  if (result.status === "malformed")
-    throw new Error(result.error);
-  return result.config ?? DEFAULTS;
-}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path2.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace, repoPreset) => {
-  const wp = workspace?.branchPolicy ?? {};
-  const workspacePreset = Object.hasOwn(PRESETS, wp.preset);
-  const detected = !workspacePreset && unchosenBranchPolicy.has(config) ? repoPreset?.() ?? null : null;
-  const preset = workspacePreset ? wp.preset : detected ?? config.branchPolicy?.preset ?? "gitflow";
-  const merged = mergePreset(preset, {
-    allowed: wp.allowed,
-    protectedNames: wp.protected
-  }, config);
-  const allowed = merged.allowed.map(branchGlobPattern);
-  return {
-    preset,
-    allowed,
-    protected: new Set([...merged.protected, ...detected ? PRESETS.gitflow.protected : []].map((p) => p.toLowerCase())),
-    integration: wp.integration === "merge" ? "merge" : "pr",
-    defaultTargetBranch: preset === "github-flow" ? "main" : preset === "trunk-based" ? "master" : "develop",
-    detected: detected !== null
-  };
-}, COMMIT_PRESETS, resolveCommitPolicy = (config, workspace) => {
-  const wp = workspace?.commitPolicy ?? {};
-  if (COMMIT_PRESETS.includes(String(wp.preset ?? ""))) {
-    return {
-      preset: wp.preset,
-      ...typeof wp.pattern === "string" ? { pattern: wp.pattern } : {}
-    };
+  walk(path2.join(path2.dirname(location.dir), "logs", "refs", "heads"));
+  if (location.git)
+    files.push(path2.join(location.git.gitDir, "logs", "HEAD"));
+  const seen = new Set;
+  const renames = [];
+  for (const file of files) {
+    let text = "";
+    try {
+      text = fs2.readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of text.matchAll(/ (\d+) [+-]\d{4}\tBranch: renamed refs\/heads\/(\S+) to refs\/heads\/(\S+)/gu)) {
+      const rename = { from: match[2], to: match[3], at: Number(match[1]) };
+      const id = `${rename.at}\x00${rename.from}\x00${rename.to}`;
+      if (seen.has(id))
+        continue;
+      seen.add(id);
+      renames.push(rename);
+    }
   }
-  return config.commitPolicy ?? { preset: "conventional" };
-};
-var init_config = __esm(() => {
-  init_boundary();
-  PRESETS = {
-    gitflow: {
-      allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
-      protected: ["main", "develop", "master", "prod", "production"]
-    },
-    "github-flow": { allowed: ["*"], protected: ["main"] },
-    "trunk-based": { allowed: ["*"], protected: ["main"] },
-    custom: { allowed: [], protected: [] }
-  };
-  LOCALE_RE = /^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/;
-  DEFAULTS = {
-    locale: "en",
-    localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
-    branchPolicy: {
-      preset: "gitflow",
-      allowed: [...PRESETS.gitflow.allowed],
-      protected: [...PRESETS.gitflow.protected]
-    },
-    commitPolicy: { preset: "conventional" }
+  return renames.toSorted((left, right) => left.at - right.at);
+}
+function followRenames(key, boundAt, renames) {
+  let current = key;
+  let since = Math.floor(Date.parse(boundAt) / 1000);
+  for (const rename of renames)
+    if (rename.from === current && rename.at >= since) {
+      current = rename.to;
+      since = rename.at;
+    }
+  return current;
+}
+var NOT_A_REPO, gitRun = (cwd, args) => {
+  const run = spawnSync2("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_OPTIONAL_LOCKS: "0",
+      LC_ALL: "C",
+      LANGUAGE: "C"
+    }
+  });
+  const error = run.error;
+  return {
+    ok: run.status === 0,
+    stdout: run.stdout ?? "",
+    stderr: error ? String(error.message) : run.stderr ?? "",
+    missing: error?.code === "ENOENT"
   };
-  unchosenBranchPolicy = new WeakSet([DEFAULTS]);
-  COMMIT_PRESETS = [
-    "conventional",
-    "gitmoji",
-    "ticket-prefix",
-    "freeform",
-    "custom",
-    "auto"
-  ];
-});
-
-// packages/workit-core/src/core/branch-policy.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-var PREFIXES, branchNames = (workspaceRoot) => {
-  const r = spawnSync2("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/remotes/origin"], { cwd: workspaceRoot, encoding: "utf8" });
-  if (r.status !== 0)
-    return new Set;
-  return new Set((r.stdout ?? "").split(`
-`).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
-}, productionBranchOf = (names) => names.has("main") ? "main" : names.has("master") ? "master" : "main", detectBranchPolicy = (workspaceRoot) => {
-  const names = branchNames(workspaceRoot);
-  const develop = names.has("develop");
-  const main = names.has("main");
-  const master = names.has("master");
-  const root = main ? "main" : master ? "master" : null;
-  if (develop) {
-    return {
-      preset: "gitflow",
-      developBranch: "develop",
-      integration: "merge",
-      protected: root ? [root, "develop"] : ["develop"],
-      allowed: [...PRESETS.gitflow.allowed],
-      prefixes: PREFIXES
-    };
+}, shortHash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 12), real = (file) => {
+  try {
+    return fs2.realpathSync.native(file);
+  } catch {
+    return file;
   }
-  if (root === "main") {
-    return {
-      preset: "github-flow",
-      developBranch: null,
-      integration: "pr",
-      protected: [root],
-      allowed: ["*"],
-      prefixes: PREFIXES
-    };
+}, DISCOVERY_ENV, isGitDir = (dir) => {
+  try {
+    return fs2.statSync(path2.join(dir, "HEAD")).isFile() && fs2.statSync(path2.join(dir, "objects")).isDirectory() && fs2.statSync(path2.join(dir, "refs")).isDirectory();
+  } catch {
+    return false;
   }
-  if (root === "master") {
-    return {
-      preset: "trunk-based",
-      developBranch: null,
-      integration: "pr",
-      protected: [root],
-      allowed: ["*"],
-      prefixes: PREFIXES
-    };
+}, reftableRefs = (common) => {
+  try {
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs2.readFileSync(path2.join(common, "config"), "utf8"));
+  } catch {
+    return false;
   }
-  return {
-    preset: "gitflow",
-    developBranch: null,
-    integration: "merge",
-    protected: [],
-    allowed: [],
-    prefixes: PREFIXES
-  };
-}, repoBranchPreset = (workspaceRoot) => {
-  const detected = detectBranchPolicy(workspaceRoot);
-  return detected.developBranch || detected.allowed.length ? detected.preset : null;
+}, rebasingBranch = (gitDir) => {
+  for (const state of ["rebase-merge", "rebase-apply"]) {
+    try {
+      const ref = fs2.readFileSync(path2.join(gitDir, state, "head-name"), "utf8").trim();
+      const match = /^refs\/heads\/(.+)$/u.exec(ref);
+      if (match)
+        return match[1];
+    } catch {}
+  }
+  return null;
+}, checkoutSlug = (root) => {
+  let canonical = real(root);
+  if (process.platform === "win32")
+    canonical = canonical.toLowerCase();
+  const base = path2.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  return `${base}-${shortHash(canonical)}`;
 };
-var init_branch_policy = __esm(() => {
-  init_config();
-  PREFIXES = {
-    feature: "feature/*",
-    bugfix: "bugfix/*",
-    release: "release/*",
-    hotfix: "hotfix/*"
-  };
+var init_paths = __esm(() => {
+  NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
+  DISCOVERY_ENV = [
+    "GIT_DIR",
+    "GIT_COMMON_DIR",
+    "GIT_WORK_TREE",
+    "GIT_CEILING_DIRECTORIES",
+    "GIT_DISCOVERY_ACROSS_FILESYSTEM"
+  ];
 });
 
-// packages/workit-core/src/core/workspaces.ts
+// packages/workit-core/src/core/store-lock.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { createHash as createHash3 } from "node:crypto";
-import { readFileSync as readFileSync2, realpathSync } from "node:fs";
-import path3 from "node:path";
-function workspaceDefaultTarget(cwd, globalDefault) {
-  const ws = resolveRuntimeWorkspaceVcs(cwd);
-  const wp = ws?.branchPolicy ?? {};
-  const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
-  const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined);
-  const policyDefault = resolveBranchPolicy(readConfig(), selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(cwd)).defaultTargetBranch;
-  return String(ws?.vcs?.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : globalDefault ?? policyDefault) ?? "develop");
-}
-var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspaceCommitPolicySchema, workspaceProfileSchema, versionSourceSchema, releaseTrackSchema, workspaceConfigSchema, workspacesFileSchema, workspacesRevision = (contents) => createHash3("sha256").update(contents ?? "<missing>").digest("hex"), validateWorkspacesDocument = (parsed, file) => {
-  if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+import fs3 from "node:fs";
+import { hostname } from "node:os";
+var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, RECLAIM_GUARD_TTL_MS = 30000, IN_PROCESS_LOCK_TIMEOUT_MS = 250, defaultLockTimeoutMs, defaultLockTimeout = () => defaultLockTimeoutMs, hostAwareLockTimeout = (cliMs) => defaultLockTimeoutMs > IN_PROCESS_LOCK_TIMEOUT_MS ? cliMs : IN_PROCESS_LOCK_TIMEOUT_MS, parseMetadataLock = (raw) => {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw Object.assign(new Error("metadata lock is invalid"), { code: "metadata_lock_invalid" });
   }
-  const validated = workspacesFileSchema.safeParse(parsed, { reportInput: true });
-  if (!validated.success) {
-    const detail = validated.error.issues.map((issue) => {
-      const field = String(issue.path[issue.path.length - 1] ?? "");
-      const attempted = ["provider", "preset", "strategy"].includes(field) && typeof issue.input === "string" ? ` (${JSON.stringify(issue.input)})` : "";
-      return `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}${attempted}`;
-    }).join("; ");
-    return {
-      status: "invalid",
-      path: file,
-      entries: [],
-      error: `${file} has invalid workspace configuration: ${detail}`
-    };
+  const parsed = metadataLockSchema.safeParse(value);
+  if (!parsed.success)
+    throw Object.assign(new Error("metadata lock is invalid"), { code: "metadata_lock_invalid" });
+  return parsed.data;
+}, parseMetadataLockOrNull = (raw) => {
+  try {
+    return parseMetadataLock(raw);
+  } catch {
+    return null;
   }
-  for (const [index, workspace] of (validated.data.workspaces ?? []).entries()) {
-    const glob = validateWorkspaceGlob(workspace.glob);
-    if (!glob.ok) {
-      return {
-        status: "invalid",
-        path: file,
-        entries: [],
-        error: `${file} workspaces.${index}.glob: ${glob.error}`
-      };
+}, parseProcStatStart = (stat) => {
+  const close = stat.lastIndexOf(")");
+  if (close < 0)
+    return null;
+  return stat.slice(close + 1).trim().split(/\s+/)[19] ?? null;
+}, processStartOf = (pid) => {
+  if (process.platform === "linux") {
+    try {
+      return parseProcStatStart(fs3.readFileSync(`/proc/${pid}/stat`, "utf8"));
+    } catch {
+      return null;
     }
   }
-  return {
-    status: "valid",
-    path: file,
-    entries: validated.data.workspaces ?? [],
-    document: parsed
-  };
-}, readWorkspacesResult = (dir = configDir()) => {
-  const file = path3.join(dir, "workspaces.json");
-  let raw;
-  try {
-    raw = readFileSync2(file, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return { status: "missing", path: file, entries: [], revision: workspacesRevision(null) };
-    return {
-      status: "malformed",
-      path: file,
-      entries: [],
-      error: `${file} could not be read: ${error instanceof Error ? error.message : String(error)}`
-    };
+  if (process.platform === "darwin" || process.platform === "freebsd") {
+    try {
+      const run = spawnSync3("ps", ["-o", "lstart=", "-p", String(pid)], {
+        encoding: "utf8",
+        timeout: 1000
+      });
+      const value = run.status === 0 ? run.stdout.trim() : "";
+      return value || null;
+    } catch {
+      return null;
+    }
   }
-  let parsed;
+  return null;
+}, readTrimmed = (file) => {
   try {
-    parsed = JSON.parse(raw);
+    return fs3.readFileSync(file, "utf8").trim() || null;
   } catch {
-    return {
-      status: "malformed",
-      path: file,
-      entries: [],
-      revision: workspacesRevision(raw),
-      error: `${file} is not valid JSON`
-    };
+    return null;
   }
-  return { ...validateWorkspacesDocument(parsed, file), revision: workspacesRevision(raw) };
-}, globToRegExp = (glob) => {
-  let out = "";
-  for (let i = 0;i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        if (glob[i + 2] === "/") {
-          if (out === "")
-            out += "/?";
-          out += "(?:[^/]+/)*";
-          i += 2;
-        } else {
-          if (i + 2 >= glob.length) {
-            if (out.endsWith("/")) {
-              out = out.slice(0, -1);
-              out += "(?:/.*)?";
-            } else {
-              out += ".*";
-            }
-          } else {
-            out += ".*";
-          }
-          i++;
-        }
-      } else {
-        out += "[^/]*";
-      }
-    } else {
-      out += c.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-    }
+}, cachedLockHost = null, localLockHost = () => {
+  if (cachedLockHost !== null)
+    return cachedLockHost;
+  let pidns = null;
+  try {
+    pidns = /\[(\d+)\]/.exec(fs3.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
+  } catch {}
+  const boot = readTrimmed("/proc/sys/kernel/random/boot_id");
+  cachedLockHost = pidns || boot ? `${hostname()}#${pidns ?? "?"}:${boot ?? "?"}` : hostname();
+  return cachedLockHost;
+}, pidAlive = (pid) => {
+  if (!Number.isSafeInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
   }
-  return new RegExp(`^${out}$`);
-}, matchWorkspace = (glob, target) => globToRegExp(glob.replaceAll("\\", "/")).test(target.replaceAll("\\", "/")), UNSUPPORTED_GLOB, UNSUPPORTED_EXTGLOB, validateWorkspaceGlob = (glob) => {
-  const trimmed = glob.trim();
-  if (!trimmed)
-    return { ok: false, error: "workspace pattern is required" };
-  const m = UNSUPPORTED_GLOB.exec(trimmed);
-  if (m) {
-    return {
-      ok: false,
-      error: `unsupported glob character ${JSON.stringify(m[0])} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
-    };
+}, TASK_STORE_LOCK, classifyLockOwner = (payload, ageMs, localHost = localLockHost(), options = {}) => {
+  const lock = metadataLockSchema.safeParse(payload);
+  if (!lock.success)
+    return ageMs !== null && ageMs > UNREADABLE_LOCK_TTL_MS ? { state: "stale", reason: "unreadable lock left behind" } : { state: "unknown", reason: "lock is being written" };
+  const { pid, processStart, host } = lock.data;
+  const [lockName, lockSpace] = host.split("#");
+  const [localName, localSpace] = localHost.split("#");
+  if (lockSpace && localSpace && lockName === localName) {
+    const [lockNs, lockBoot] = lockSpace.split(":");
+    const [localNs, localBoot] = localSpace.split(":");
+    if (lockNs === localNs && lockNs !== "?" && lockBoot !== "?" && lockBoot !== localBoot)
+      return { state: "stale", reason: "lock was taken before this machine rebooted" };
   }
-  const ext = UNSUPPORTED_EXTGLOB.exec(trimmed);
-  if (ext) {
-    const token = ext[0];
-    const kind = token === "!" ? "negation (!)" : `extglob (${token})`;
+  if (host !== localHost)
+    return ageMs !== null && ageMs > FOREIGN_LOCK_TTL_MS ? { state: "stale", reason: `lock from ${host} is older than its TTL` } : { state: "unknown", reason: `lock is held from ${host}; its pid cannot be checked here` };
+  if (!pidAlive(pid))
+    return { state: "stale", reason: `pid ${pid} is not running` };
+  const currentStart = processStartOf(pid);
+  if (processStart !== null && currentStart !== null && processStart !== currentStart)
+    return { state: "stale", reason: `pid ${pid} now belongs to a different process` };
+  if (options.reclaimUnverifiedAfterTtl === true && (processStart === null || currentStart === null) && ageMs !== null && ageMs > FOREIGN_LOCK_TTL_MS)
     return {
-      ok: false,
-      error: `unsupported glob ${kind} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
+      state: "stale",
+      reason: `pid ${pid} is running but the lock is older than its TTL and the pid's start time cannot be checked (reused pid)`
     };
-  }
-  return { ok: true };
-}, WorkspaceConfigError, mainCheckouts, mainCheckoutOf = (cwd) => {
-  const cached = mainCheckouts.get(cwd);
-  if (cached !== undefined)
-    return cached;
-  const env = { ...process.env };
-  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_INDEX_FILE"])
-    delete env[name];
-  const git = (args) => {
-    const run = spawnSync3("git", args, {
-      cwd,
-      env,
-      encoding: "utf8",
-      timeout: 5000,
-      windowsHide: true
-    });
-    return run.status === 0 ? run.stdout : null;
-  };
-  let main = null;
-  const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
-  const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
-  if (gitDir && common && path3.resolve(gitDir) !== path3.resolve(common)) {
-    const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
-    main = listed?.trim() || (path3.basename(common) === ".git" ? path3.dirname(common) : common);
-  }
-  mainCheckouts.set(cwd, main);
-  return main;
-}, matchingEntries = (cwd, entries) => {
-  const match = (where) => {
-    const targets = [where, realpathOf(where)].map((value) => value.replaceAll("\\", "/"));
-    return entries.filter((entry) => {
-      const glob = entry.glob.replaceAll("\\", "/");
-      const canonical = canonicalGlob(glob);
-      return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
-    });
-  };
-  const direct = match(cwd);
-  if (direct.length)
-    return direct;
-  const main = mainCheckoutOf(cwd);
-  return main ? match(main) : direct;
-}, realpathOf = (p) => {
-  const real = realpathSync.native ?? realpathSync;
+  return { state: "live", reason: `held by running pid ${pid}` };
+}, ageOf = (file, nowMs) => {
   try {
-    return real(p);
+    return nowMs - fs3.lstatSync(file).mtimeMs;
   } catch {
-    return p;
-  }
-}, canonicalGlob = (glob) => {
-  const m = /[*?[\]{]/.exec(glob);
-  const prefix = m ? glob.slice(0, m.index) : glob;
-  const rest = m ? glob.slice(m.index) : "";
-  if (!prefix)
-    return glob;
-  const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
-  return real + (prefix.endsWith("/") ? "/" : "") + rest;
-}, globSpecificity = (glob) => glob.replaceAll("\\", "/").split("/").filter((segment) => segment.length > 0 && !/[*?[\]{]/.test(segment)).length, selectWorkspaceMatch = (matches, cwd, workspaceName) => {
-  if (workspaceName !== undefined) {
-    const named = matches.filter((entry) => entry.name === workspaceName);
-    if (named.length === 1)
-      return named[0];
-    if (named.length > 1)
-      throw new WorkspaceConfigError(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
-    if (matches.length > 0) {
-      throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
-    }
-    throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
-  }
-  if (matches.length < 2)
-    return matches[0];
-  const highestSpecificity = Math.max(...matches.map((entry) => globSpecificity(entry.glob)));
-  const mostSpecific = matches.filter((entry) => globSpecificity(entry.glob) === highestSpecificity);
-  if (mostSpecific.length > 1) {
-    throw new WorkspaceConfigError(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
-  }
-  return mostSpecific[0];
-}, resolveWorkspaceFromEntries = (cwd, entries, workspaceName) => {
-  const matches = matchingEntries(cwd, entries);
-  return selectWorkspaceMatch(matches, cwd, workspaceName) ?? null;
-}, resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
-  const result = readWorkspacesResult(dir);
-  if (result.status === "malformed" || result.status === "invalid")
-    throw new WorkspaceConfigError(result.error);
-  return resolveWorkspaceFromEntries(cwd, result.entries, workspaceName);
-}, runtimeWorkspacePolicySchema = (kind) => {
-  const key = kind === "branch" ? "branchPolicy" : kind === "commit" ? "commitPolicy" : "vcs";
-  const policySchema = kind === "branch" ? workspaceBranchPolicySchema : kind === "commit" ? workspaceCommitPolicySchema : object({
-    provider: _enum(["gitlab", "github"]),
-    defaultTargetBranch: nonBlank.optional(),
-    account: nonBlank.optional()
-  }).passthrough();
-  const profileSchema = object({ [key]: policySchema.optional() }).passthrough();
-  const entrySchema = object({
-    name: nonBlank,
-    glob: nonBlank,
-    [key]: policySchema.optional(),
-    defaultProfile: nonBlank.optional(),
-    profiles: record(nonBlank, profileSchema).optional()
-  }).passthrough();
-  return entrySchema;
-}, resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs"), runtimeWorkspaceIndexSchema, matchRuntimeWorkspace = (cwd, dir = configDir()) => {
-  const file = path3.join(dir, "workspaces.json");
-  let raw;
-  try {
-    raw = readFileSync2(file, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return null;
-    throw new WorkspaceConfigError(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    return null;
   }
-  let parsed;
+}, clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
+  const guard = `${lockPath}.reclaim`;
+  const age = ageOf(guard, nowMs);
+  if (age === null || age <= RECLAIM_GUARD_TTL_MS)
+    return false;
   try {
-    parsed = JSON.parse(raw);
+    fs3.rmdirSync(guard);
+    return true;
   } catch {
-    throw new WorkspaceConfigError(`${file} is not valid JSON`);
-  }
-  const validated = runtimeWorkspaceIndexSchema.safeParse(parsed);
-  if (!validated.success) {
-    const detail = validated.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}`).join("; ");
-    throw new WorkspaceConfigError(`${file} has invalid workspace matching data: ${detail}`);
-  }
-  const entries = validated.data.workspaces;
-  for (const entry of entries ?? []) {
-    const glob = validateWorkspaceGlob(entry.glob);
-    if (!glob.ok)
-      throw new WorkspaceConfigError(`${file} workspace ${entry.name}: ${glob.error}`);
+    return false;
   }
-  const matches = matchingEntries(cwd, entries ?? []);
-  const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
-  const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  return selected ? { file, selected, matches } : null;
-}, resolveRuntimeReleaseTracks = (cwd) => {
-  const matched = matchRuntimeWorkspace(cwd);
-  return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
-}, workspaceTrailers = (cwd, dir) => {
-  let matched;
-  try {
-    matched = matchRuntimeWorkspace(cwd, dir);
-  } catch {
-    return { enabled: true, workspace: null, from: null };
+};
+var init_store_lock = __esm(() => {
+  init_zod();
+  init_task_contract();
+  init_paths();
+  metadataLockSchema = object({
+    pid: number2().int().nonnegative().safe(),
+    processStart: string2().nullable(),
+    host: string2().min(1),
+    nonce: string2().min(1),
+    externalAction: literal(true).optional()
+  }).strict();
+  FOREIGN_LOCK_TTL_MS = 10 * 60000;
+  defaultLockTimeoutMs = IN_PROCESS_LOCK_TIMEOUT_MS;
+  TASK_STORE_LOCK = { reclaimUnverifiedAfterTtl: true };
+});
+
+// packages/workit-core/src/core/boundary.ts
+var EVENT, errorDetail = (err) => {
+  if (err instanceof Error) {
+    return { error_name: err.name, error: err.message };
   }
-  if (!matched)
-    return { enabled: true, workspace: null, from: null };
-  const { selected, matches } = matched;
-  const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
-  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return { error_name: "unknown", error: String(err) };
+};
+var init_boundary = __esm(() => {
+  EVENT = {
+    initialization: "initialization",
+    provenance: "provenance",
+    assets: "assets",
+    configurationSource: "configuration_source",
+    hooks: "hooks",
+    mcpConnection: "mcp_connection",
+    migration: "migration",
+    installSteps: "install_steps",
+    uncaughtFailure: "uncaught_failure",
+    toolsFailed: "tools_failed",
+    doctor: "doctor"
+  };
+});
+
+// packages/workit-core/src/core/config.ts
+import {
+  copyFileSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  writeFileSync
+} from "node:fs";
+import os2 from "node:os";
+import path3 from "node:path";
+var diagnosticLogger, PRESETS, mergePreset = (preset, input = {}, current = {
+  branchPolicy: { preset, allowed: [], protected: [] }
+}) => {
+  const defs = PRESETS[preset];
   return {
-    enabled: source?.trailers !== false,
-    workspace: selected.name,
-    from: source?.name ?? null
+    preset,
+    allowed: preset === "custom" ? input.allowed ?? current.branchPolicy.allowed : [...defs.allowed],
+    protected: preset === "custom" ? input.protectedNames ?? current.branchPolicy.protected : [...defs.protected]
   };
-}, resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
-  const matched = matchRuntimeWorkspace(cwd);
-  if (!matched)
+}, resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path3.join(process.env.XDG_CONFIG_HOME || path3.join(os2.homedir(), ".config"), "workit"), migratedDir = null, migrationFailed = false, ensureConfigDir = (dir = resolveConfigDir()) => {
+  if (migratedDir === dir)
+    return dir;
+  if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
+    migratedDir = dir;
+    return dir;
+  }
+  const legacy = path3.join(process.env.XDG_CONFIG_HOME || path3.join(os2.homedir(), ".config"), "workflow-toolkit");
+  if (!existsSync(legacy)) {
+    migratedDir = dir;
+    return dir;
+  }
+  if (!migrationFailed && existsSync(dir)) {
+    migratedDir = dir;
+    return dir;
+  }
+  migrationFailed = false;
+  mkdirSync(dir, { recursive: true });
+  diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
+  for (const entry of readdirSync(legacy, { withFileTypes: true })) {
+    const src = path3.join(legacy, entry.name);
+    const dest = path3.join(dir, entry.name);
+    if (existsSync(dest))
+      continue;
+    try {
+      if (entry.isDirectory())
+        cpSync(src, dest, { recursive: true });
+      else if (entry.isFile())
+        copyFileSync(src, dest);
+    } catch (err) {
+      migrationFailed = true;
+      diagnosticLogger?.warn(EVENT.migration, { from: src, ok: false, ...errorDetail(err) });
+      console.warn(`[workit] config migration: a file could not be copied to ${dir}; it will be retried on the next run`);
+    }
+  }
+  if (!migrationFailed)
+    migratedDir = dir;
+  return dir;
+}, configDir = () => ensureConfigDir(), LOCALE_RE, DEFAULTS, unchosenBranchPolicy, readSafe = (p) => {
+  try {
+    return readFileSync(p, "utf8");
+  } catch {
     return null;
-  const { file, selected } = matched;
-  const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
-  if (!policy.success) {
-    const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
-    throw new WorkspaceConfigError(`${file} has invalid ${kind} policy configuration: ${detail}`);
   }
-  return policy.data;
-}, resolveRuntimeWorkspacePolicy = (cwd, kind, requestedProfile) => {
-  const candidate = resolveRuntimeWorkspaceCandidate(cwd, kind);
-  if (!candidate)
-    return { policy: undefined, source: "user-default" };
-  const key = kind === "branch" ? "branchPolicy" : "commitPolicy";
-  const profileName = requestedProfile?.trim() || candidate.defaultProfile;
-  if (candidate.defaultProfile && !Object.hasOwn(candidate.profiles ?? {}, candidate.defaultProfile))
-    throw new WorkspaceConfigError(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(candidate.defaultProfile)}`);
-  const profile = profileName ? candidate.profiles?.[profileName] : undefined;
-  if (profileName && !profile)
-    throw new WorkspaceConfigError(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(profileName)}`);
-  const profilePolicy = profile?.[key];
-  const workspacePolicy = candidate[key];
+}, isConfigObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value), parseConfigResult = (raw, file) => {
+  if (raw === null)
+    return { status: "missing", path: file };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "malformed", path: file, error: `${file} is not valid JSON` };
+  }
+  if (!isConfigObject(parsed)) {
+    return { status: "malformed", path: file, error: `${file} is not a JSON object` };
+  }
+  const input = parsed;
+  const locale = LOCALE_RE.test(String(input.locale ?? "")) ? input.locale : DEFAULTS.locale;
+  const preset = Object.hasOwn(PRESETS, input.branchPolicy?.preset) ? input.branchPolicy?.preset : "gitflow";
+  const commitPreset = COMMIT_PRESETS.includes(String(input.commitPolicy?.preset ?? "")) ? input.commitPolicy?.preset : "conventional";
+  const config = {
+    locale,
+    localeOptions: Array.isArray(input.localeOptions) ? input.localeOptions : DEFAULTS.localeOptions,
+    branchPolicy: mergePreset(preset, {
+      allowed: Array.isArray(input.branchPolicy?.allowed) ? input.branchPolicy.allowed : undefined,
+      protectedNames: Array.isArray(input.branchPolicy?.protected) ? input.branchPolicy.protected : undefined
+    }, DEFAULTS),
+    commitPolicy: {
+      preset: commitPreset,
+      ...typeof input.commitPolicy?.pattern === "string" ? { pattern: input.commitPolicy.pattern } : {}
+    }
+  };
+  if (!Object.hasOwn(PRESETS, input.branchPolicy?.preset))
+    unchosenBranchPolicy.add(config);
+  return { status: "valid", path: file, config };
+}, readConfigTyped = (dir) => {
+  const file = path3.join(dir ?? configDir(), "config.json");
+  return parseConfigResult(readSafe(file), file);
+}, readConfig = () => {
+  const result = readConfigTyped();
+  if (result.status === "malformed")
+    throw new Error(result.error);
+  return result.config ?? DEFAULTS;
+}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path3.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace, repoPreset) => {
+  const wp = workspace?.branchPolicy ?? {};
+  const workspacePreset = Object.hasOwn(PRESETS, wp.preset);
+  const detected = !workspacePreset && unchosenBranchPolicy.has(config) ? repoPreset?.() ?? null : null;
+  const preset = workspacePreset ? wp.preset : detected ?? config.branchPolicy?.preset ?? "gitflow";
+  const merged = mergePreset(preset, {
+    allowed: wp.allowed,
+    protectedNames: wp.protected
+  }, config);
+  const allowed = merged.allowed.map(branchGlobPattern);
   return {
-    policy: profilePolicy ?? workspacePolicy,
-    source: profilePolicy ? `profile:${profileName}` : workspacePolicy ? `workspace:${candidate.name}` : "user-default"
+    preset,
+    allowed,
+    protected: new Set([...merged.protected, ...detected ? PRESETS.gitflow.protected : []].map((p) => p.toLowerCase())),
+    integration: wp.integration === "merge" ? "merge" : "pr",
+    defaultTargetBranch: preset === "github-flow" ? "main" : preset === "trunk-based" ? "master" : "develop",
+    detected: detected !== null
   };
+}, COMMIT_PRESETS, resolveCommitPolicy = (config, workspace) => {
+  const wp = workspace?.commitPolicy ?? {};
+  if (COMMIT_PRESETS.includes(String(wp.preset ?? ""))) {
+    return {
+      preset: wp.preset,
+      ...typeof wp.pattern === "string" ? { pattern: wp.pattern } : {}
+    };
+  }
+  return config.commitPolicy ?? { preset: "conventional" };
 };
-var init_workspaces = __esm(() => {
-  init_zod();
-  init_config();
-  init_branch_policy();
-  nonBlank = string2().refine((value) => value.trim().length > 0, "must not be blank");
-  branchPreset = custom((value) => typeof value === "string" && Object.hasOwn(PRESETS, value), "unsupported branch preset");
-  commitPreset = custom((value) => typeof value === "string" && COMMIT_PRESETS.includes(value), "unsupported commit preset");
-  workspaceBranchPolicySchema = object({
-    preset: branchPreset,
-    developBranch: nonBlank.optional(),
-    prefixes: object({
-      feature: nonBlank,
-      bugfix: nonBlank,
-      release: nonBlank,
-      hotfix: nonBlank
-    }).passthrough().optional(),
-    allowed: array(nonBlank).optional(),
-    protected: array(nonBlank).optional(),
-    integration: _enum(["pr", "merge"]).optional()
-  }).strict();
-  workspaceCommitPolicySchema = object({ preset: commitPreset, pattern: string2().optional() }).strict();
-  workspaceProfileSchema = object({
-    branchPolicy: workspaceBranchPolicySchema.optional(),
-    commitPolicy: workspaceCommitPolicySchema.optional()
-  }).strict().refine((profile) => profile.branchPolicy !== undefined || profile.commitPolicy !== undefined, {
-    message: "a profile must define branchPolicy or commitPolicy"
-  });
-  versionSourceSchema = discriminatedUnion("kind", [
-    object({
-      kind: literal("package-json"),
-      path: nonBlank,
-      field: nonBlank
-    }).strict(),
-    object({ kind: literal("git-tag") }).strict(),
-    object({ kind: literal("manual") }).strict()
-  ]);
-  releaseTrackSchema = object({
-    strategy: branchPreset.optional(),
-    productionBranch: nonBlank,
-    integrationBranch: nonBlank,
-    naming: object({
-      feature: nonBlank.optional(),
-      release: nonBlank.optional(),
-      hotfix: nonBlank.optional()
-    }).passthrough().optional(),
-    baseBranch: nonBlank.optional(),
-    mergeBackBranches: array(nonBlank).optional(),
-    pullRequestTarget: nonBlank.optional(),
-    tagNamespace: string2().optional(),
-    versionSource: versionSourceSchema.optional(),
-    requiredChecks: array(nonBlank).optional(),
-    critical: array(nonBlank).optional()
-  }).passthrough().superRefine((track, context) => {
-    for (const [field, values] of [
-      ["mergeBackBranches", track.mergeBackBranches ?? []],
-      ["requiredChecks", track.requiredChecks ?? []]
-    ]) {
-      if (new Set(values).size !== values.length) {
-        context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
-      }
-    }
-    if (track.versionSource?.kind === "package-json" && (path3.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
-      context.addIssue({
-        code: "custom",
-        path: ["versionSource", "path"],
-        message: "must stay inside the repository"
-      });
-    }
-  });
-  workspaceConfigSchema = object({
-    name: nonBlank,
-    glob: nonBlank,
-    vcs: object({
-      provider: _enum(["gitlab", "github"]),
-      defaultTargetBranch: nonBlank.optional(),
-      tokenFile: nonBlank.optional(),
-      account: nonBlank.optional()
-    }).passthrough().optional(),
-    autoApprove: union([boolean2(), array(nonBlank)]).optional(),
-    defaultEndpoint: unknown().optional(),
-    verification: _enum(["self", "independent"]).optional(),
-    trailers: boolean2().optional(),
-    autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
-      kind,
-      union([boolean2(), literal("verified")]).optional()
-    ]))).passthrough().optional(),
-    youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
-    issues: object({ provider: literal("github").optional(), link_on_pr: boolean2().optional() }).passthrough().optional(),
-    branchPolicy: workspaceBranchPolicySchema.optional(),
-    commitPolicy: workspaceCommitPolicySchema.optional(),
-    defaultProfile: nonBlank.optional(),
-    profiles: record(nonBlank, workspaceProfileSchema).optional(),
-    releaseTracks: record(nonBlank, releaseTrackSchema).optional()
-  }).passthrough().superRefine((workspace, context) => {
-    if (workspace.issues && workspace.vcs?.provider !== "github") {
-      context.addIssue({
-        code: "custom",
-        path: ["issues"],
-        message: `GitHub issue linking requires the github provider, got ${workspace.vcs?.provider ?? "unset"}`
-      });
-    }
-    if (workspace.defaultProfile !== undefined && !Object.hasOwn(workspace.profiles ?? {}, workspace.defaultProfile)) {
-      context.addIssue({
-        code: "custom",
-        path: ["defaultProfile"],
-        message: `does not name a configured profile`
-      });
-    }
-  });
-  workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).optional() }).passthrough().superRefine((file, context) => {
-    const names = new Set;
-    for (const [index, workspace] of (file.workspaces ?? []).entries()) {
-      if (names.has(workspace.name)) {
-        context.addIssue({
-          code: "custom",
-          path: ["workspaces", index, "name"],
-          message: `duplicate workspace name ${JSON.stringify(workspace.name)}`
-        });
-      }
-      names.add(workspace.name);
-    }
-  });
-  UNSUPPORTED_GLOB = /[?[\]{}]/;
-  UNSUPPORTED_EXTGLOB = /[@+*]\(|!/;
-  WorkspaceConfigError = class WorkspaceConfigError extends Error {
-    name = "WorkspaceConfigError";
+var init_config = __esm(() => {
+  init_boundary();
+  PRESETS = {
+    gitflow: {
+      allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
+      protected: ["main", "develop", "master", "prod", "production"]
+    },
+    "github-flow": { allowed: ["*"], protected: ["main"] },
+    "trunk-based": { allowed: ["*"], protected: ["main"] },
+    custom: { allowed: [], protected: [] }
   };
-  mainCheckouts = new Map;
-  runtimeWorkspaceIndexSchema = object({
-    workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
-  }).passthrough();
+  LOCALE_RE = /^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/;
+  DEFAULTS = {
+    locale: "en",
+    localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
+    branchPolicy: {
+      preset: "gitflow",
+      allowed: [...PRESETS.gitflow.allowed],
+      protected: [...PRESETS.gitflow.protected]
+    },
+    commitPolicy: { preset: "conventional" }
+  };
+  unchosenBranchPolicy = new WeakSet([DEFAULTS]);
+  COMMIT_PRESETS = [
+    "conventional",
+    "gitmoji",
+    "ticket-prefix",
+    "freeform",
+    "custom",
+    "auto"
+  ];
 });
 
-// packages/workit-core/src/core/release-tracks.ts
-import { createHash as createHash4 } from "node:crypto";
+// packages/workit-core/src/core/branch-policy.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-function readReleaseTracks(raw) {
-  const out = { tracks: [], issues: [], error: null, protectedBranches: [] };
-  if (raw === undefined || raw === null)
-    return out;
-  if (!isRecord(raw)) {
-    out.issues.push("releaseTracks is not an object; ignored");
-    return out;
-  }
-  const fatal = [];
-  const protectedNames = new Set;
-  for (const [name, entry] of Object.entries(raw).toSorted(([a], [b]) => a < b ? -1 : 1)) {
-    const label = `release track ${JSON.stringify(name)}`;
-    if (!isRecord(entry)) {
-      out.issues.push(`${label} is not an object; ignored`);
-      continue;
-    }
-    for (const branch of namedBranches(entry))
-      protectedNames.add(branch);
-    if (!name.trim()) {
-      out.issues.push("a release track with a blank name was ignored");
-      continue;
-    }
-    let critical = [];
-    if (Array.isArray(entry.critical))
-      critical = entry.critical.filter((item) => typeof item === "string");
-    else if (entry.critical !== undefined)
-      out.issues.push(`${label} critical: must be a list of field names; ignored`);
-    const isCritical = (field) => critical.some((item) => field === item || field.startsWith(`${item}.`));
-    const problem = (field, message) => {
-      if (isCritical(field))
-        fatal.push(`${label} ${field}: ${message}`);
-      else
-        out.issues.push(`${label} ${field}: ${message}`);
+var PREFIXES, branchNames = (workspaceRoot) => {
+  const r = spawnSync4("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/remotes/origin"], { cwd: workspaceRoot, encoding: "utf8" });
+  if (r.status !== 0)
+    return new Set;
+  return new Set((r.stdout ?? "").split(`
+`).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
+}, productionBranchOf = (names) => names.has("main") ? "main" : names.has("master") ? "master" : "main", detectBranchPolicy = (workspaceRoot) => {
+  const names = branchNames(workspaceRoot);
+  const develop = names.has("develop");
+  const main = names.has("main");
+  const master = names.has("master");
+  const root = main ? "main" : master ? "master" : null;
+  if (develop) {
+    return {
+      preset: "gitflow",
+      developBranch: "develop",
+      integration: "merge",
+      protected: root ? [root, "develop"] : ["develop"],
+      allowed: [...PRESETS.gitflow.allowed],
+      prefixes: PREFIXES
     };
-    for (const key of Object.keys(entry))
-      if (!KNOWN_FIELDS.has(key))
-        problem(key, "unknown field, ignored");
-    const productionBranch = branchName(entry.productionBranch);
-    const integrationBranch = branchName(entry.integrationBranch);
-    if (!productionBranch)
-      problem("productionBranch", "missing or not a branch name");
-    if (!integrationBranch)
-      problem("integrationBranch", "missing or not a branch name");
-    const optionalBranch = (field) => {
-      if (entry[field] === undefined)
-        return null;
-      const value = branchName(entry[field]);
-      if (!value)
-        problem(field, "not a branch name; using the integration branch");
-      return value;
+  }
+  if (root === "main") {
+    return {
+      preset: "github-flow",
+      developBranch: null,
+      integration: "pr",
+      protected: [root],
+      allowed: ["*"],
+      prefixes: PREFIXES
     };
-    const baseBranch = optionalBranch("baseBranch");
-    const pullRequestTarget = optionalBranch("pullRequestTarget");
-    let mergeBackBranches = [];
-    if (entry.mergeBackBranches !== undefined) {
-      const list = Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : [null];
-      if (list.some((item) => item === null))
-        problem("mergeBackBranches", "must be a list of branch names; ignored");
-      else
-        mergeBackBranches = [...new Set(list)];
-    }
-    const naming = {};
-    if (entry.naming !== undefined) {
-      if (!isRecord(entry.naming))
-        problem("naming", "not an object; ignored");
-      else
-        for (const kind of ["feature", "release", "hotfix"]) {
-          const template = entry.naming[kind];
-          if (template === undefined)
-            continue;
-          if (typeof template !== "string" || !template.trim())
-            problem(`naming.${kind}`, "not a template string; ignored");
-          else if (!literalOf(template))
-            problem(`naming.${kind}`, "needs literal text besides placeholders; ignored");
-          else
-            naming[kind] = template.trim();
-        }
-    }
-    if (!productionBranch || !integrationBranch) {
-      out.issues.push(`${label} was skipped: it needs a productionBranch and integrationBranch`);
-      continue;
-    }
-    out.tracks.push({
-      name,
-      productionBranch,
-      integrationBranch,
-      baseBranch: baseBranch ?? integrationBranch,
-      pullRequestTarget: pullRequestTarget ?? integrationBranch,
-      mergeBackBranches,
-      naming
-    });
   }
-  out.protectedBranches = [...protectedNames];
-  if (fatal.length)
-    out.error = `workspace releaseTracks cannot be read by this Workit (${fatal.join("; ")}); upgrade Workit or fix the track`;
-  return out;
-}
-function resolveReleaseTrack(input) {
-  const tracks = [...input.tracks];
-  const issues = [...input.issues ?? []];
-  const requested = input.requested?.trim();
-  if (tracks.length === 0) {
-    if (requested)
-      return {
-        status: "invalid",
-        error: `no release tracks configured for this workspace; --track ${requested} cannot apply`,
-        issues
-      };
-    return { status: "none", issues };
+  if (root === "master") {
+    return {
+      preset: "trunk-based",
+      developBranch: null,
+      integration: "pr",
+      protected: [root],
+      allowed: ["*"],
+      prefixes: PREFIXES
+    };
   }
-  const names = tracks.map((track) => track.name).join(", ");
-  let envProblem = null;
-  const done = (track, source, detail, warnings = [], ambiguous = null) => ({
-    status: "resolved",
-    track: track && track.name !== IMPLICIT ? track : null,
-    source,
-    detail,
-    warnings: [...issues, ...envProblem ? [envProblem] : [], ...warnings],
-    tracks,
-    blocking: envProblem ?? ambiguous
-  });
-  if (requested) {
-    const named = tracks.find((track) => track.name === requested);
-    if (!named)
+  return {
+    preset: "gitflow",
+    developBranch: null,
+    integration: "merge",
+    protected: [],
+    allowed: [],
+    prefixes: PREFIXES
+  };
+}, repoBranchPreset = (workspaceRoot) => {
+  const detected = detectBranchPolicy(workspaceRoot);
+  return detected.developBranch || detected.allowed.length ? detected.preset : null;
+}, releaseTagPrefixOf = (workspaceRoot, policyPrefix) => {
+  if (typeof policyPrefix === "string")
+    return policyPrefix.trim();
+  const r = spawnSync4("git", ["config", "--get", "gitflow.prefix.versiontag"], {
+    cwd: workspaceRoot,
+    encoding: "utf8"
+  });
+  return r.status === 0 ? (r.stdout ?? "").trim() : "v";
+};
+var init_branch_policy = __esm(() => {
+  init_config();
+  PREFIXES = {
+    feature: "feature/*",
+    bugfix: "bugfix/*",
+    release: "release/*",
+    hotfix: "hotfix/*"
+  };
+});
+
+// packages/workit-core/src/core/workspaces.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { createHash as createHash4 } from "node:crypto";
+import { readFileSync as readFileSync2, realpathSync } from "node:fs";
+import path4 from "node:path";
+function workspaceDefaultTarget(cwd, globalDefault) {
+  const ws = resolveRuntimeWorkspaceVcs(cwd);
+  const wp = ws?.branchPolicy ?? {};
+  const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
+  const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined);
+  const policyDefault = resolveBranchPolicy(readConfig(), selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(cwd)).defaultTargetBranch;
+  return String(ws?.vcs?.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : globalDefault ?? policyDefault) ?? "develop");
+}
+var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspaceCommitPolicySchema, workspaceProfileSchema, versionSourceSchema, releaseTrackSchema, workspaceConfigSchema, workspacesFileSchema, workspacesRevision = (contents) => createHash4("sha256").update(contents ?? "<missing>").digest("hex"), validateWorkspacesDocument = (parsed, file) => {
+  if (!isConfigObject(parsed)) {
+    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+  }
+  const validated = workspacesFileSchema.safeParse(parsed, { reportInput: true });
+  if (!validated.success) {
+    const detail = validated.error.issues.map((issue) => {
+      const field = String(issue.path[issue.path.length - 1] ?? "");
+      const attempted = ["provider", "preset", "strategy"].includes(field) && typeof issue.input === "string" ? ` (${JSON.stringify(issue.input)})` : "";
+      return `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}${attempted}`;
+    }).join("; ");
+    return {
+      status: "invalid",
+      path: file,
+      entries: [],
+      error: `${file} has invalid workspace configuration: ${detail}`
+    };
+  }
+  for (const [index, workspace] of (validated.data.workspaces ?? []).entries()) {
+    const glob = validateWorkspaceGlob(workspace.glob);
+    if (!glob.ok) {
       return {
         status: "invalid",
-        error: `no release track ${JSON.stringify(requested)}; configured: ${names}`,
-        issues
+        path: file,
+        entries: [],
+        error: `${file} workspaces.${index}.glob: ${glob.error}`
       };
-    return done(named, "flag", `track ${named.name} was requested explicitly`);
+    }
   }
-  const owned = (branch) => branch !== null && tracks.some((track) => [
-    track.integrationBranch,
-    track.productionBranch,
-    track.baseBranch,
-    track.pullRequestTarget
-  ].includes(branch));
-  const implicit = input.defaultBranch && !owned(input.defaultBranch) ? {
-    name: IMPLICIT,
-    productionBranch: input.defaultBranch,
-    integrationBranch: input.defaultBranch,
-    baseBranch: input.defaultBranch,
-    pullRequestTarget: input.defaultBranch,
-    mergeBackBranches: [],
-    naming: {}
-  } : null;
-  const candidates = implicit ? [...tracks, implicit] : tracks;
-  const label = (track) => track.name === IMPLICIT ? `the workspace default line (${track.integrationBranch})` : `track ${track.name}`;
-  const fallback = (why) => {
-    const byDefault = input.defaultBranch ? tracks.filter((track) => track.integrationBranch === input.defaultBranch || track.pullRequestTarget === input.defaultBranch) : [];
-    const track = byDefault.length === 1 ? byDefault[0] : null;
-    const target = track ? `track ${track.name}` : `default target ${input.defaultBranch ?? "(none)"}`;
-    const ambiguous = candidates.length >= 2 ? `can't tell which release line ${input.branch ?? "HEAD"} is on (${why}); pass --track <name> (${names}) or --base <branch>` : null;
-    return done(track, "default", `${why}; using the workspace ${target}`, [
-      `release track not determined: ${why}; using the workspace ${target} (pass --track <name> to choose)`
-    ], ambiguous);
+  return {
+    status: "valid",
+    path: file,
+    entries: validated.data.workspaces ?? [],
+    document: parsed
   };
-  const branch = input.branch;
-  if (branch) {
-    const owners = ownedBy(candidates, branch);
-    if (owners.length === 1)
-      return done(owners[0], "branch", `${branch} is a branch of ${label(owners[0])}`);
-    if (owners.length > 1)
-      return fallback(`${branch} belongs to more than one track (${owners.map((track) => track.name).join(", ")})`);
+}, readWorkspacesResult = (dir = configDir()) => {
+  const file = path4.join(dir, "workspaces.json");
+  let raw;
+  try {
+    raw = readFileSync2(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { status: "missing", path: file, entries: [], revision: workspacesRevision(null) };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      error: `${file} could not be read: ${error instanceof Error ? error.message : String(error)}`
+    };
   }
-  const env = input.envRequested?.trim();
-  if (env) {
-    const named = tracks.find((track) => track.name === env);
-    if (named)
-      return done(named, "env", `WORKFLOW_RELEASE_TRACK selects track ${named.name}`);
-    envProblem = `WORKFLOW_RELEASE_TRACK=${env} names no release track of this workspace (${names}); ignored`;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      revision: workspacesRevision(raw),
+      error: `${file} is not valid JSON`
+    };
   }
-  if (!branch)
-    return fallback("HEAD is detached");
-  if (tracks.length === 1 && !implicit)
-    return done(tracks[0], "only-track", `${tracks[0].name} is the only track`);
-  let remotes = null;
-  const short = (ref) => shortRef(ref, remotes ??= input.probe.remotes());
-  const ownerOf = (ref) => {
-    const owner = ownedBy(candidates, short(ref));
-    return owner.length === 1 ? owner[0] : null;
-  };
-  const followRecorded = (start) => {
-    let cursor = start;
-    const seen = new Set([start]);
-    for (let hop = 0;hop < MAX_RECORDED_HOPS; hop += 1) {
-      const recorded = input.probe.recordedBase(cursor);
-      if (!recorded)
-        return null;
-      const base = short(recorded);
-      const owner = ownerOf(base);
-      if (owner)
-        return owner;
-      if (ownedBy(candidates, base).length > 1 || seen.has(base))
-        return null;
-      seen.add(base);
-      cursor = base;
+  return { ...validateWorkspacesDocument(parsed, file), revision: workspacesRevision(raw) };
+}, globToRegExp = (glob) => {
+  let out = "";
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          if (out === "")
+            out += "/?";
+          out += "(?:[^/]+/)*";
+          i += 2;
+        } else {
+          if (i + 2 >= glob.length) {
+            if (out.endsWith("/")) {
+              out = out.slice(0, -1);
+              out += "(?:/.*)?";
+            } else {
+              out += ".*";
+            }
+          } else {
+            out += ".*";
+          }
+          i++;
+        }
+      } else {
+        out += "[^/]*";
+      }
+    } else {
+      out += c.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
     }
-    return null;
-  };
-  const recordedOwner = followRecorded(branch);
-  if (recordedOwner)
-    return done(recordedOwner, "recorded-base", `${branch} was created on ${label(recordedOwner)}'s line (recorded base)`);
-  for (const source of ["reflog", "checkout"]) {
-    const ref = source === "reflog" ? input.probe.createdFrom(branch) : input.probe.checkedOutFrom(branch);
-    if (!ref)
-      continue;
-    const owner = ownerOf(ref) ?? followRecorded(short(ref));
-    if (owner)
-      return done(owner, source, `${branch} was created from ${short(ref)} (${source === "reflog" ? "branch reflog" : "HEAD reflog"})`);
   }
-  const forks = [];
-  for (const track of candidates)
-    for (const ref of new Set([track.integrationBranch, track.baseBranch])) {
-      const sha = input.probe.mergeBase(branch, ref);
-      if (sha)
-        forks.push({ track, ref, sha });
-    }
-  if (forks.length === 0)
-    return fallback(`no track branch could be compared with ${branch} (fetch the track branches)`);
-  const ancestry = new Map;
-  const descends = (older, newer) => {
-    if (older === newer)
-      return false;
-    const key = `${older}>${newer}`;
-    if (!ancestry.has(key))
-      ancestry.set(key, input.probe.isAncestor(older, newer));
-    return ancestry.get(key);
-  };
-  const winners = forks.filter((fork) => forks.every((other) => other.track === fork.track || descends(other.sha, fork.sha)));
-  const winningTracks = [...new Set(winners.map((fork) => fork.track))];
-  if (winningTracks.length === 1 && forks.some((fork) => fork.track !== winningTracks[0])) {
-    const win = winners[0];
-    return done(win.track, "ancestry", `${branch} forked from ${win.ref} at ${win.sha.slice(0, 12)}, after every other line's fork point`);
+  return new RegExp(`^${out}$`);
+}, matchWorkspace = (glob, target) => globToRegExp(glob.replaceAll("\\", "/")).test(target.replaceAll("\\", "/")), UNSUPPORTED_GLOB, UNSUPPORTED_EXTGLOB, validateWorkspaceGlob = (glob) => {
+  const trimmed = glob.trim();
+  if (!trimmed)
+    return { ok: false, error: "workspace pattern is required" };
+  const m = UNSUPPORTED_GLOB.exec(trimmed);
+  if (m) {
+    return {
+      ok: false,
+      error: `unsupported glob character ${JSON.stringify(m[0])} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
+    };
   }
-  if (winningTracks.length === 1)
-    return fallback(`only ${label(winningTracks[0])} could be compared with ${branch}`);
-  const newest = forks.filter((fork) => !forks.some((other) => descends(fork.sha, other.sha)));
-  return fallback(`${branch} has the same or unrelated fork points with ${[...new Set(newest.map((fork) => `${fork.ref} (${fork.track.name === IMPLICIT ? "workspace default" : fork.track.name})`))].join(" and ")}`);
-}
-function gitTrackProbe(cwd) {
-  let remote;
-  let remotes;
-  const tip = (branch) => {
-    remote ??= pushRemoteName(cwd) ?? "origin";
-    return resolveRef(cwd, `refs/remotes/${remote}/${branch}`) ?? resolveRef(cwd, `refs/heads/${branch}`);
-  };
-  return {
-    remotes: () => remotes ??= remoteNames(cwd),
-    recordedBase: (branch) => git2(cwd, ["config", "--get", recordedBaseKey(branch)]) || null,
-    createdFrom: (branch) => {
-      const log = git2(cwd, ["reflog", "show", "--format=%gs", `refs/heads/${branch}`, "--"]);
-      const oldest = log?.split(`
-`).findLast(Boolean) ?? "";
-      const match = /^branch: Created from (\S+)$/u.exec(oldest);
-      return match && match[1] !== "HEAD" ? match[1] : null;
-    },
-    checkedOutFrom: (branch) => {
-      const own = reflog(cwd, `refs/heads/${branch}`);
-      const created = own.at(-1);
-      if (!created || created.subject !== "branch: Created from HEAD")
-        return null;
-      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp(branch)}$`, "u");
-      const entry = reflog(cwd, "HEAD").findLast((item) => item.time >= created.time && item.sha === created.sha && pattern.test(item.subject));
-      return entry ? pattern.exec(entry.subject)?.[1] ?? null : null;
-    },
-    mergeBase: (branch, trackBranch) => {
-      const base = tip(trackBranch);
-      return base && resolveRef(cwd, `refs/heads/${branch}`) ? mergeBase(cwd, base, `refs/heads/${branch}`) : null;
-    },
-    isAncestor: (ancestor, descendant) => git2(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]) !== null
-  };
-}
-function workspaceReleaseTracks(cwd) {
-  const raw = resolveRuntimeReleaseTracks(cwd);
-  return { workspace: raw?.workspace ?? null, ...readReleaseTracks(raw?.releaseTracks) };
-}
-function resolveTrackFor(cwd, options) {
-  const read = workspaceReleaseTracks(cwd);
-  if (read.error)
-    return { status: "invalid", error: read.error, issues: read.issues };
-  if (read.tracks.length === 0 && !options.track?.trim())
-    return { status: "none", issues: read.issues };
-  const branch = options.branch === undefined ? currentBranch(cwd) : options.branch;
-  const envRequested = process.env.WORKFLOW_RELEASE_TRACK?.trim() || null;
-  const input = {
-    tracks: read.tracks,
-    requested: options.track ?? null,
-    envRequested,
-    branch,
-    defaultBranch: options.defaultBranch,
-    issues: read.issues
-  };
-  let key = null;
-  if (!options.probe) {
-    const refs = git2(cwd, [
-      "for-each-ref",
-      "--format=%(refname) %(objectname)",
-      "refs/heads",
-      "refs/remotes"
-    ]) ?? "";
-    const head = git2(cwd, ["reflog", "show", "-n", "1", "--format=%H %gs", "HEAD", "--"]) ?? "";
-    const own = branch ? [
-      git2(cwd, [
-        "log",
-        "-g",
-        "-n",
-        "1",
-        "--date=unix",
-        "--format=%H %gd %gs",
-        `refs/heads/${branch}`,
-        "--"
-      ]) ?? "",
-      git2(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
-    ] : [];
-    key = createHash4("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
-    const hit = memo2.get(key);
-    if (hit)
-      return hit;
-  }
-  const resolution = resolveReleaseTrack({ ...input, probe: options.probe ?? gitTrackProbe(cwd) });
-  if (key) {
-    if (memo2.size >= MEMO_LIMIT)
-      memo2.delete(memo2.keys().next().value);
-    memo2.set(key, resolution);
+  const ext = UNSUPPORTED_EXTGLOB.exec(trimmed);
+  if (ext) {
+    const token = ext[0];
+    const kind = token === "!" ? "negation (!)" : `extglob (${token})`;
+    return {
+      ok: false,
+      error: `unsupported glob ${kind} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
+    };
   }
-  return resolution;
-}
-var ReleaseTrackError, KNOWN_FIELDS, BRANCH_FIELDS, PLACEHOLDER, HAS_PLACEHOLDER, isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value), branchName = (value) => typeof value === "string" && value.trim() && !value.trim().startsWith("-") ? value.trim() : null, namedBranches = (entry) => [
-  ...BRANCH_FIELDS.map((field) => branchName(entry[field])),
-  ...Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : []
-].filter((name) => name !== null), literalOf = (template) => template.replace(PLACEHOLDER, "").replace(/[*/]/gu, "").trim(), trackBranches = (tracks) => [
-  ...new Set(tracks.flatMap((track) => [
-    track.productionBranch,
-    track.integrationBranch,
-    track.baseBranch,
-    track.pullRequestTarget,
-    ...track.mergeBackBranches
-  ]))
-], namingGlob = (template) => HAS_PLACEHOLDER.test(template) ? template.replace(PLACEHOLDER, "*") : `${template.replace(/\/?\*?$/u, "")}/*`, IMPLICIT = "", ownedBy = (tracks, branch) => tracks.filter((track) => [track.integrationBranch, track.productionBranch, track.baseBranch].includes(branch)), shortRef = (ref, remotes) => {
-  const bare = ref.replace(/^refs\/heads\//u, "").replace(/^refs\/remotes\/[^/]+\//u, "");
-  const remote = remotes.find((name) => bare.startsWith(`${name}/`));
-  return remote ? bare.slice(remote.length + 1) : bare;
-}, MAX_RECORDED_HOPS = 10, git2 = (cwd, args) => {
-  const run = spawnSync4("git", args, {
-    cwd,
-    encoding: "utf8",
-    timeout: 20000,
-    windowsHide: true,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  return run.status === 0 ? (run.stdout ?? "").trim() : null;
-}, recordedBaseKey = (branch) => `branch.${branch}.workitBase`, escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), reflog = (cwd, ref) => (git2(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
-`).map((line) => {
-  const [sha = "", selector = "", ...subject] = line.split("\t");
-  return {
-    sha,
-    time: Number(/@\{(\d+)\}$/u.exec(selector)?.[1] ?? Number.NaN),
-    subject: subject.join("\t")
-  };
-}).filter((entry) => entry.sha && Number.isFinite(entry.time)), memo2, MEMO_LIMIT = 64;
-var init_release_tracks = __esm(() => {
-  init_rev();
-  init_config();
-  init_workspaces();
-  ReleaseTrackError = class ReleaseTrackError extends Error {
+  return { ok: true };
+}, WorkspaceConfigError, mainCheckouts, mainCheckoutOf = (cwd) => {
+  const cached = mainCheckouts.get(cwd);
+  if (cached !== undefined)
+    return cached;
+  const env = { ...process.env };
+  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_INDEX_FILE"])
+    delete env[name];
+  const git = (args) => {
+    const run = spawnSync5("git", args, {
+      cwd,
+      env,
+      encoding: "utf8",
+      timeout: 5000,
+      windowsHide: true
+    });
+    return run.status === 0 ? run.stdout : null;
   };
-  KNOWN_FIELDS = new Set([
-    "strategy",
-    "productionBranch",
-    "integrationBranch",
-    "naming",
-    "baseBranch",
-    "mergeBackBranches",
-    "pullRequestTarget",
-    "tagNamespace",
-    "versionSource",
-    "requiredChecks",
-    "critical"
-  ]);
-  BRANCH_FIELDS = ["productionBranch", "integrationBranch", "baseBranch", "pullRequestTarget"];
-  PLACEHOLDER = /\{[^}]*\}/gu;
-  HAS_PLACEHOLDER = /\{[^}]*\}/u;
-  memo2 = new Map;
-});
-
-// packages/workit-core/src/core/vcs-config.ts
-import fs2 from "node:fs";
-import path4 from "node:path";
-import { spawnSync as spawnSync5 } from "node:child_process";
-function vcsConfig(mode, cwd, options = {}) {
-  const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
-  const wsVcs = ws?.vcs ?? {};
-  const wsYt = ws?.youtrack ?? {};
-  const wsIssues = ws?.issues ?? {};
-  const { status: cfgStatus, path: cfgPath, config: cfg, error: cfgError } = readVcsConfig();
-  const root = vcsCwd(cwd);
-  const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
-  const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
-  const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
-  const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
-  const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
-  const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
-  let issuesProvider = null;
-  let linkOnPr = null;
-  if (provider === "github" && typeof wsIssues.provider === "string" && wsIssues.provider.toLowerCase() === "github") {
-    issuesProvider = "github";
-    linkOnPr = typeof wsIssues.link_on_pr === "boolean" ? wsIssues.link_on_pr : null;
+  let main = null;
+  const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
+  const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
+  if (gitDir && common && path4.resolve(gitDir) !== path4.resolve(common)) {
+    const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
+    main = listed?.trim() || (path4.basename(common) === ".git" ? path4.dirname(common) : common);
   }
-  if (mode === "resolve") {
-    if (cfgStatus === "malformed")
-      return { ok: false, error: cfgError, configPath: cfgPath };
-    const trackResolution = resolveTrackFor(root, {
-      track: options.track,
-      ...options.branch !== undefined ? { branch: options.branch } : {},
-      defaultBranch: workspaceDefault
+  mainCheckouts.set(cwd, main);
+  return main;
+}, matchingEntries = (cwd, entries) => {
+  const match = (where) => {
+    const targets = [where, realpathOf(where)].map((value) => value.replaceAll("\\", "/"));
+    return entries.filter((entry) => {
+      const glob = entry.glob.replaceAll("\\", "/");
+      const canonical = canonicalGlob(glob);
+      return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
     });
-    if (trackResolution.status === "invalid")
-      return { ok: false, error: trackResolution.error, configPath: workspacesPath() };
-    const releaseTrack = trackSummary(trackResolution);
-    const defaultTarget = releaseTrack?.track?.pullRequestTarget ?? workspaceDefault;
-    const baseBranch = releaseTrack?.track?.baseBranch ?? defaultTarget;
-    return {
-      ok: true,
-      workspace_name: ws?.name ?? null,
-      provider,
-      defaultTargetBranch: defaultTarget,
-      workspaceDefaultTargetBranch: workspaceDefault,
-      baseBranch,
-      releaseTrack,
-      link_issues: linkIssues,
-      youtrack_base_url: youtrackBaseUrl,
-      issues_provider: issuesProvider,
-      link_on_pr: linkOnPr
-    };
-  }
-  if (cfgStatus === "malformed") {
-    return { ok: false, error: cfgError, configPath: cfgPath };
+  };
+  const direct = match(cwd);
+  if (direct.length)
+    return direct;
+  const main = mainCheckoutOf(cwd);
+  return main ? match(main) : direct;
+}, realpathOf = (p) => {
+  const real = realpathSync.native ?? realpathSync;
+  try {
+    return real(p);
+  } catch {
+    return p;
   }
-  if (cfgStatus === "missing" && provider === null)
-    return { ok: false, error: `vcs.json is missing: ${cfgPath}`, configPath: cfgPath };
-  if (provider === null) {
-    return {
-      ok: false,
-      error: `no vcs provider configured (set vcs.provider in ${cfgPath}, match a workspace entry, or run inside a checkout with a recognized origin remote)`,
-      configPath: cfgPath
-    };
+}, canonicalGlob = (glob) => {
+  const m = /[*?[\]{]/.exec(glob);
+  const prefix = m ? glob.slice(0, m.index) : glob;
+  const rest = m ? glob.slice(m.index) : "";
+  if (!prefix)
+    return glob;
+  const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
+  return real + (prefix.endsWith("/") ? "/" : "") + rest;
+}, globSpecificity = (glob) => glob.replaceAll("\\", "/").split("/").filter((segment) => segment.length > 0 && !/[*?[\]{]/.test(segment)).length, selectWorkspaceMatch = (matches, cwd, workspaceName) => {
+  if (workspaceName !== undefined) {
+    const named = matches.filter((entry) => entry.name === workspaceName);
+    if (named.length === 1)
+      return named[0];
+    if (named.length > 1)
+      throw new WorkspaceConfigError(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
+    if (matches.length > 0) {
+      throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
+    }
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
   }
-  const prov = cfg[provider] ?? {};
-  const out = {
-    ok: true,
-    configPath: path4.resolve(cfgPath),
-    provider,
-    defaultTargetBranch: workspaceDefault,
-    pr: cfg.pr ?? {},
-    workspace_name: ws?.name ?? null,
-    link_issues: linkIssues,
-    youtrack_base_url: youtrackBaseUrl,
-    issues_provider: issuesProvider,
-    link_on_pr: linkOnPr
-  };
-  if (provider === "gitlab") {
-    out.gitlab = {
-      host: prov.host ?? "gitlab.com",
-      apiUrl: prov.apiUrl ?? "https://gitlab.com/api/v4"
-    };
-  } else if (provider === "github") {
-    out.github = { host: prov.host ?? "github.com" };
+  if (matches.length < 2)
+    return matches[0];
+  const highestSpecificity = Math.max(...matches.map((entry) => globSpecificity(entry.glob)));
+  const mostSpecific = matches.filter((entry) => globSpecificity(entry.glob) === highestSpecificity);
+  if (mostSpecific.length > 1) {
+    throw new WorkspaceConfigError(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
   }
-  return out;
-}
-var workspacesPath = () => path4.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
-  const r = spawnSync5("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
-  if (r.status !== 0)
-    return null;
-  const url = (r.stdout ?? "").trim();
-  if (/github\.com[:/]/.test(url))
-    return "github";
-  if (/gitlab\.com[:/]/.test(url))
-    return "gitlab";
-  return null;
-}, readVcsConfig = () => {
-  const file = vcsConfigPath();
+  return mostSpecific[0];
+}, resolveWorkspaceFromEntries = (cwd, entries, workspaceName) => {
+  const matches = matchingEntries(cwd, entries);
+  return selectWorkspaceMatch(matches, cwd, workspaceName) ?? null;
+}, resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
+  const result = readWorkspacesResult(dir);
+  if (result.status === "malformed" || result.status === "invalid")
+    throw new WorkspaceConfigError(result.error);
+  return resolveWorkspaceFromEntries(cwd, result.entries, workspaceName);
+}, runtimeWorkspacePolicySchema = (kind) => {
+  const key = kind === "branch" ? "branchPolicy" : kind === "commit" ? "commitPolicy" : "vcs";
+  const policySchema = kind === "branch" ? workspaceBranchPolicySchema : kind === "commit" ? workspaceCommitPolicySchema : object({
+    provider: _enum(["gitlab", "github"]),
+    defaultTargetBranch: nonBlank.optional(),
+    account: nonBlank.optional()
+  }).passthrough();
+  const profileSchema = object({ [key]: policySchema.optional() }).passthrough();
+  const entrySchema = object({
+    name: nonBlank,
+    glob: nonBlank,
+    [key]: policySchema.optional(),
+    defaultProfile: nonBlank.optional(),
+    profiles: record(nonBlank, profileSchema).optional()
+  }).passthrough();
+  return entrySchema;
+}, resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs"), runtimeWorkspaceIndexSchema, matchRuntimeWorkspace = (cwd, dir = configDir()) => {
+  const file = path4.join(dir, "workspaces.json");
   let raw;
   try {
-    raw = fs2.readFileSync(file, "utf8");
-  } catch {
-    return { status: "missing", path: file, config: {} };
+    raw = readFileSync2(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw new WorkspaceConfigError(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return { status: "malformed", path: file, config: {}, error: `${file} is not valid JSON` };
+    throw new WorkspaceConfigError(`${file} is not valid JSON`);
   }
-  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-    return { status: "valid", path: file, config: parsed };
+  const validated = runtimeWorkspaceIndexSchema.safeParse(parsed);
+  if (!validated.success) {
+    const detail = validated.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}`).join("; ");
+    throw new WorkspaceConfigError(`${file} has invalid workspace matching data: ${detail}`);
   }
-  return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
-}, trackSummary = (resolution) => resolution.status === "resolved" ? {
-  name: resolution.track?.name ?? null,
-  source: resolution.source,
-  detail: resolution.detail,
-  warnings: resolution.warnings,
-  track: resolution.track,
-  tracks: resolution.tracks,
-  blocking: resolution.blocking
-} : null;
-var init_vcs_config = __esm(() => {
-  init_config();
-  init_workspaces();
-  init_release_tracks();
-});
-
-// packages/workit-core/src/core/logger.ts
-import os3 from "node:os";
-import path5 from "node:path";
-var SENSITIVE_WORDS, STACK_WORDS, escapeRegExp2 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), resolveStateDir = () => {
-  const override = process.env.WORKFLOW_TOOLKIT_STATE;
-  if (override)
-    return override;
-  const home = os3.homedir();
-  if (process.env.XDG_STATE_HOME)
-    return path5.join(process.env.XDG_STATE_HOME, "workit");
-  switch (os3.platform()) {
-    case "darwin":
-      return path5.join(home, "Library", "Application Support", "workit");
-    case "win32":
-      return path5.join(process.env.LOCALAPPDATA ?? path5.join(home, "AppData", "Local"), "workit");
-    default:
-      return path5.join(process.env.HOME ?? home, ".local", "state", "workit");
+  const entries = validated.data.workspaces;
+  for (const entry of entries ?? []) {
+    const glob = validateWorkspaceGlob(entry.glob);
+    if (!glob.ok)
+      throw new WorkspaceConfigError(`${file} workspace ${entry.name}: ${glob.error}`);
   }
-}, homePattern;
-var init_logger = __esm(() => {
-  SENSITIVE_WORDS = new Set([
-    "token",
-    "secret",
-    "password",
-    "passwd",
-    "authorization",
-    "credential",
-    "credentials",
-    "cookie",
-    "api",
-    "apikey",
-    "apitoken",
-    "accesstoken",
-    "clientsecret",
-    "refreshtoken",
-    "key",
-    "bearer",
-    "prompt",
-    "message",
-    "messages",
-    "content",
-    "body",
-    "args",
-    "argument",
-    "result",
-    "results",
-    "output",
-    "issue",
-    "description",
-    "summary",
-    "payload",
-    "script",
-    "command",
-    "text",
-    "query"
+  const matches = matchingEntries(cwd, entries ?? []);
+  const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
+  const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
+  return selected ? { file, selected, matches } : null;
+}, resolveRuntimeReleaseTracks = (cwd) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+}, workspaceTrailers = (cwd, dir) => {
+  let matched;
+  try {
+    matched = matchRuntimeWorkspace(cwd, dir);
+  } catch {
+    return { enabled: true, workspace: null, from: null };
+  }
+  if (!matched)
+    return { enabled: true, workspace: null, from: null };
+  const { selected, matches } = matched;
+  const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return {
+    enabled: source?.trailers !== false,
+    workspace: selected.name,
+    from: source?.name ?? null
+  };
+}, resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  if (!matched)
+    return null;
+  const { file, selected } = matched;
+  const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
+  if (!policy.success) {
+    const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
+    throw new WorkspaceConfigError(`${file} has invalid ${kind} policy configuration: ${detail}`);
+  }
+  return policy.data;
+}, resolveRuntimeWorkspacePolicy = (cwd, kind, requestedProfile) => {
+  const candidate = resolveRuntimeWorkspaceCandidate(cwd, kind);
+  if (!candidate)
+    return { policy: undefined, source: "user-default" };
+  const key = kind === "branch" ? "branchPolicy" : "commitPolicy";
+  const profileName = requestedProfile?.trim() || candidate.defaultProfile;
+  if (candidate.defaultProfile && !Object.hasOwn(candidate.profiles ?? {}, candidate.defaultProfile))
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(candidate.defaultProfile)}`);
+  const profile = profileName ? candidate.profiles?.[profileName] : undefined;
+  if (profileName && !profile)
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(profileName)}`);
+  const profilePolicy = profile?.[key];
+  const workspacePolicy = candidate[key];
+  return {
+    policy: profilePolicy ?? workspacePolicy,
+    source: profilePolicy ? `profile:${profileName}` : workspacePolicy ? `workspace:${candidate.name}` : "user-default"
+  };
+};
+var init_workspaces = __esm(() => {
+  init_zod();
+  init_config();
+  init_branch_policy();
+  nonBlank = string2().refine((value) => value.trim().length > 0, "must not be blank");
+  branchPreset = custom((value) => typeof value === "string" && Object.hasOwn(PRESETS, value), "unsupported branch preset");
+  commitPreset = custom((value) => typeof value === "string" && COMMIT_PRESETS.includes(value), "unsupported commit preset");
+  workspaceBranchPolicySchema = object({
+    preset: branchPreset,
+    developBranch: nonBlank.optional(),
+    prefixes: object({
+      feature: nonBlank,
+      bugfix: nonBlank,
+      release: nonBlank,
+      hotfix: nonBlank
+    }).passthrough().optional(),
+    allowed: array(nonBlank).optional(),
+    protected: array(nonBlank).optional(),
+    integration: _enum(["pr", "merge"]).optional()
+  }).strict();
+  workspaceCommitPolicySchema = object({ preset: commitPreset, pattern: string2().optional() }).strict();
+  workspaceProfileSchema = object({
+    branchPolicy: workspaceBranchPolicySchema.optional(),
+    commitPolicy: workspaceCommitPolicySchema.optional()
+  }).strict().refine((profile) => profile.branchPolicy !== undefined || profile.commitPolicy !== undefined, {
+    message: "a profile must define branchPolicy or commitPolicy"
+  });
+  versionSourceSchema = discriminatedUnion("kind", [
+    object({
+      kind: literal("package-json"),
+      path: nonBlank,
+      field: nonBlank
+    }).strict(),
+    object({ kind: literal("git-tag") }).strict(),
+    object({ kind: literal("manual") }).strict()
   ]);
-  STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
-  homePattern = new RegExp(`${escapeRegExp2(os3.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
+  releaseTrackSchema = object({
+    strategy: branchPreset.optional(),
+    productionBranch: nonBlank,
+    integrationBranch: nonBlank,
+    naming: object({
+      feature: nonBlank.optional(),
+      release: nonBlank.optional(),
+      hotfix: nonBlank.optional()
+    }).passthrough().optional(),
+    baseBranch: nonBlank.optional(),
+    mergeBackBranches: array(nonBlank).optional(),
+    pullRequestTarget: nonBlank.optional(),
+    tagNamespace: string2().optional(),
+    versionSource: versionSourceSchema.optional(),
+    requiredChecks: array(nonBlank).optional(),
+    critical: array(nonBlank).optional()
+  }).passthrough().superRefine((track, context) => {
+    for (const [field, values] of [
+      ["mergeBackBranches", track.mergeBackBranches ?? []],
+      ["requiredChecks", track.requiredChecks ?? []]
+    ]) {
+      if (new Set(values).size !== values.length) {
+        context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
+      }
+    }
+    if (track.versionSource?.kind === "package-json" && (path4.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+      context.addIssue({
+        code: "custom",
+        path: ["versionSource", "path"],
+        message: "must stay inside the repository"
+      });
+    }
+  });
+  workspaceConfigSchema = object({
+    name: nonBlank,
+    glob: nonBlank,
+    vcs: object({
+      provider: _enum(["gitlab", "github"]),
+      defaultTargetBranch: nonBlank.optional(),
+      tokenFile: nonBlank.optional(),
+      account: nonBlank.optional()
+    }).passthrough().optional(),
+    autoApprove: union([boolean2(), array(nonBlank)]).optional(),
+    defaultEndpoint: unknown().optional(),
+    verification: _enum(["self", "independent"]).optional(),
+    trailers: boolean2().optional(),
+    autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
+      kind,
+      union([boolean2(), literal("verified")]).optional()
+    ]))).passthrough().optional(),
+    youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
+    issues: object({ provider: literal("github").optional(), link_on_pr: boolean2().optional() }).passthrough().optional(),
+    branchPolicy: workspaceBranchPolicySchema.optional(),
+    commitPolicy: workspaceCommitPolicySchema.optional(),
+    defaultProfile: nonBlank.optional(),
+    profiles: record(nonBlank, workspaceProfileSchema).optional(),
+    releaseTracks: record(nonBlank, releaseTrackSchema).optional()
+  }).passthrough().superRefine((workspace, context) => {
+    if (workspace.issues && workspace.vcs?.provider !== "github") {
+      context.addIssue({
+        code: "custom",
+        path: ["issues"],
+        message: `GitHub issue linking requires the github provider, got ${workspace.vcs?.provider ?? "unset"}`
+      });
+    }
+    if (workspace.defaultProfile !== undefined && !Object.hasOwn(workspace.profiles ?? {}, workspace.defaultProfile)) {
+      context.addIssue({
+        code: "custom",
+        path: ["defaultProfile"],
+        message: `does not name a configured profile`
+      });
+    }
+  });
+  workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).optional() }).passthrough().superRefine((file, context) => {
+    const names = new Set;
+    for (const [index, workspace] of (file.workspaces ?? []).entries()) {
+      if (names.has(workspace.name)) {
+        context.addIssue({
+          code: "custom",
+          path: ["workspaces", index, "name"],
+          message: `duplicate workspace name ${JSON.stringify(workspace.name)}`
+        });
+      }
+      names.add(workspace.name);
+    }
+  });
+  UNSUPPORTED_GLOB = /[?[\]{}]/;
+  UNSUPPORTED_EXTGLOB = /[@+*]\(|!/;
+  WorkspaceConfigError = class WorkspaceConfigError extends Error {
+    name = "WorkspaceConfigError";
+  };
+  mainCheckouts = new Map;
+  runtimeWorkspaceIndexSchema = object({
+    workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
+  }).passthrough();
 });
 
-// packages/workit-core/src/store/paths.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
+// packages/workit-core/src/core/release-tracks.ts
 import { createHash as createHash5 } from "node:crypto";
-import fs3 from "node:fs";
-import path6 from "node:path";
-function fastGit(root) {
-  if (DISCOVERY_ENV.some((name) => process.env[name]))
-    return null;
-  let dir = real(root);
-  let device = null;
-  for (;; ) {
-    let stat;
-    try {
-      stat = fs3.statSync(dir);
-    } catch {
-      return null;
+import { spawnSync as spawnSync6 } from "node:child_process";
+function readReleaseTracks(raw) {
+  const out = { tracks: [], issues: [], error: null, protectedBranches: [] };
+  if (raw === undefined || raw === null)
+    return out;
+  if (!isRecord(raw)) {
+    out.issues.push("releaseTracks is not an object; ignored");
+    return out;
+  }
+  const fatal = [];
+  const protectedNames = new Set;
+  for (const [name, entry] of Object.entries(raw).toSorted(([a], [b]) => a < b ? -1 : 1)) {
+    const label = `release track ${JSON.stringify(name)}`;
+    if (!isRecord(entry)) {
+      out.issues.push(`${label} is not an object; ignored`);
+      continue;
     }
-    if (device !== null && stat.dev !== device)
-      return { kind: "none" };
-    device = stat.dev;
-    const dotGit = path6.join(dir, ".git");
-    let entry = null;
-    try {
-      entry = fs3.statSync(dotGit);
-    } catch {}
-    let gitDir = null;
-    let top = null;
-    if (entry) {
-      top = dir;
-      if (entry.isDirectory())
-        gitDir = dotGit;
-      else if (entry.isFile()) {
-        let text = "";
-        try {
-          text = fs3.readFileSync(dotGit, "utf8");
-        } catch {
-          return null;
-        }
-        const match = /^gitdir: (.+)$/mu.exec(text);
-        if (!match)
-          return null;
-        gitDir = path6.resolve(dir, match[1].trim());
-      } else
-        return null;
-      if (!fs3.existsSync(path6.join(gitDir, "HEAD")))
-        return null;
-    } else if (isGitDir(dir))
-      gitDir = dir;
-    if (gitDir) {
-      let common = gitDir;
-      try {
-        common = path6.resolve(gitDir, fs3.readFileSync(path6.join(gitDir, "commondir"), "utf8").trim());
-      } catch {}
-      if (!fs3.existsSync(path6.join(common, "objects")))
-        return null;
-      return {
-        kind: "repo",
-        common: real(common),
-        gitDir: real(gitDir),
-        top: top === null ? null : real(top),
-        reftable: reftableRefs(common)
-      };
+    for (const branch of namedBranches(entry))
+      protectedNames.add(branch);
+    if (!name.trim()) {
+      out.issues.push("a release track with a blank name was ignored");
+      continue;
     }
-    const parent = path6.dirname(dir);
-    if (parent === dir)
-      return { kind: "none" };
-    dir = parent;
-  }
-}
-function resolveStore(root) {
-  root = path6.resolve(root);
-  let directory = false;
-  try {
-    directory = fs3.statSync(root).isDirectory();
-  } catch {}
-  if (!directory)
-    return { dir: path6.join(root, ".workit"), shared: false, top: null };
-  const fast = fastGit(root);
-  if (fast?.kind === "none")
-    return { dir: path6.join(root, ".workit"), shared: false, top: null };
-  if (fast?.kind === "repo")
-    return {
-      dir: path6.join(fast.common, "workit"),
-      shared: true,
-      top: fast.top,
-      git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
+    let critical = [];
+    if (Array.isArray(entry.critical))
+      critical = entry.critical.filter((item) => typeof item === "string");
+    else if (entry.critical !== undefined)
+      out.issues.push(`${label} critical: must be a list of field names; ignored`);
+    const isCritical = (field) => critical.some((item) => field === item || field.startsWith(`${item}.`));
+    const problem = (field, message) => {
+      if (isCritical(field))
+        fatal.push(`${label} ${field}: ${message}`);
+      else
+        out.issues.push(`${label} ${field}: ${message}`);
     };
-  const run = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
-  const common = run.stdout.trim();
-  if (run.ok && common) {
-    const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
-    return {
-      dir: path6.join(real(path6.resolve(root, common)), "workit"),
-      shared: true,
-      top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
+    for (const key of Object.keys(entry))
+      if (!KNOWN_FIELDS.has(key))
+        problem(key, "unknown field, ignored");
+    const productionBranch = branchName(entry.productionBranch);
+    const integrationBranch = branchName(entry.integrationBranch);
+    if (!productionBranch)
+      problem("productionBranch", "missing or not a branch name");
+    if (!integrationBranch)
+      problem("integrationBranch", "missing or not a branch name");
+    const optionalBranch = (field) => {
+      if (entry[field] === undefined)
+        return null;
+      const value = branchName(entry[field]);
+      if (!value)
+        problem(field, "not a branch name; using the integration branch");
+      return value;
     };
+    const baseBranch = optionalBranch("baseBranch");
+    const pullRequestTarget = optionalBranch("pullRequestTarget");
+    let mergeBackBranches = [];
+    if (entry.mergeBackBranches !== undefined) {
+      const list = Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : [null];
+      if (list.some((item) => item === null))
+        problem("mergeBackBranches", "must be a list of branch names; ignored");
+      else
+        mergeBackBranches = [...new Set(list)];
+    }
+    const naming = {};
+    if (entry.naming !== undefined) {
+      if (!isRecord(entry.naming))
+        problem("naming", "not an object; ignored");
+      else
+        for (const kind of ["feature", "release", "hotfix"]) {
+          const template = entry.naming[kind];
+          if (template === undefined)
+            continue;
+          if (typeof template !== "string" || !template.trim())
+            problem(`naming.${kind}`, "not a template string; ignored");
+          else if (!literalOf(template))
+            problem(`naming.${kind}`, "needs literal text besides placeholders; ignored");
+          else
+            naming[kind] = template.trim();
+        }
+    }
+    if (!productionBranch || !integrationBranch) {
+      out.issues.push(`${label} was skipped: it needs a productionBranch and integrationBranch`);
+      continue;
+    }
+    out.tracks.push({
+      name,
+      productionBranch,
+      integrationBranch,
+      baseBranch: baseBranch ?? integrationBranch,
+      pullRequestTarget: pullRequestTarget ?? integrationBranch,
+      mergeBackBranches,
+      naming
+    });
   }
-  if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path6.join(root, ".workit"), shared: false, top: null };
-  return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
-`)[0] || "no output"}); fix the repository (git status should work here)`);
+  out.protectedBranches = [...protectedNames];
+  if (fatal.length)
+    out.error = `workspace releaseTracks cannot be read by this Workit (${fatal.join("; ")}); upgrade Workit or fix the track`;
+  return out;
 }
-function resolveTaskKey(root, location) {
-  if (!location.shared)
-    return { key: `dir-${shortHash(root)}`, kind: "dir", branch: null };
-  const branchKey = (name) => ({ key: name, kind: "branch", branch: name });
-  if (location.git && !location.git.reftable) {
-    let head = "";
-    try {
-      head = fs3.readFileSync(path6.join(location.git.gitDir, "HEAD"), "utf8").trim();
-    } catch {}
-    const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
-    if (ref && ref[1] !== ".invalid")
-      return branchKey(ref[1]);
-    if (/^[0-9a-f]{40,64}$/u.test(head)) {
-      const rebasing = rebasingBranch(location.git.gitDir);
-      if (rebasing)
-        return branchKey(rebasing);
+function resolveReleaseTrack(input) {
+  const tracks = [...input.tracks];
+  const issues = [...input.issues ?? []];
+  const requested = input.requested?.trim();
+  if (tracks.length === 0) {
+    if (requested)
       return {
-        key: `detached-${shortHash(location.git.top ?? location.git.gitDir)}`,
-        kind: "detached",
-        branch: null
+        status: "invalid",
+        error: `no release tracks configured for this workspace; --track ${requested} cannot apply`,
+        issues
       };
-    }
+    return { status: "none", issues };
   }
-  const branch = gitRun(root, ["symbolic-ref", "-q", "--short", "HEAD"]);
-  const name = branch.ok ? branch.stdout.trim() : "";
-  if (name && name !== ".invalid")
-    return branchKey(name);
-  const gitDir = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-dir"]);
-  if (gitDir.ok && gitDir.stdout.trim()) {
-    const rebasing = rebasingBranch(gitDir.stdout.trim());
-    if (rebasing)
-      return branchKey(rebasing);
+  const names = tracks.map((track) => track.name).join(", ");
+  let envProblem = null;
+  const done = (track, source, detail, warnings = [], ambiguous = null) => ({
+    status: "resolved",
+    track: track && track.name !== IMPLICIT ? track : null,
+    source,
+    detail,
+    warnings: [...issues, ...envProblem ? [envProblem] : [], ...warnings],
+    tracks,
+    blocking: envProblem ?? ambiguous
+  });
+  if (requested) {
+    const named = tracks.find((track) => track.name === requested);
+    if (!named)
+      return {
+        status: "invalid",
+        error: `no release track ${JSON.stringify(requested)}; configured: ${names}`,
+        issues
+      };
+    return done(named, "flag", `track ${named.name} was requested explicitly`);
   }
-  const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
-  const worktree = top.ok && top.stdout.trim() ? top.stdout.trim() : root;
-  return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
-}
-function checkoutRootOf(root, location) {
-  const resolved = path6.resolve(root);
-  let canonical = resolved;
-  try {
-    canonical = fs3.realpathSync(resolved);
-  } catch {
-    return resolved;
+  const owned = (branch) => branch !== null && tracks.some((track) => [
+    track.integrationBranch,
+    track.productionBranch,
+    track.baseBranch,
+    track.pullRequestTarget
+  ].includes(branch));
+  const implicit = input.defaultBranch && !owned(input.defaultBranch) ? {
+    name: IMPLICIT,
+    productionBranch: input.defaultBranch,
+    integrationBranch: input.defaultBranch,
+    baseBranch: input.defaultBranch,
+    pullRequestTarget: input.defaultBranch,
+    mergeBackBranches: [],
+    naming: {}
+  } : null;
+  const candidates = implicit ? [...tracks, implicit] : tracks;
+  const label = (track) => track.name === IMPLICIT ? `the workspace default line (${track.integrationBranch})` : `track ${track.name}`;
+  const fallback = (why) => {
+    const byDefault = input.defaultBranch ? tracks.filter((track) => track.integrationBranch === input.defaultBranch || track.pullRequestTarget === input.defaultBranch) : [];
+    const track = byDefault.length === 1 ? byDefault[0] : null;
+    const target = track ? `track ${track.name}` : `default target ${input.defaultBranch ?? "(none)"}`;
+    const ambiguous = candidates.length >= 2 ? `can't tell which release line ${input.branch ?? "HEAD"} is on (${why}); pass --track <name> (${names}) or --base <branch>` : null;
+    return done(track, "default", `${why}; using the workspace ${target}`, [
+      `release track not determined: ${why}; using the workspace ${target} (pass --track <name> to choose)`
+    ], ambiguous);
+  };
+  const branch = input.branch;
+  if (branch) {
+    const owners = ownedBy(candidates, branch);
+    if (owners.length === 1)
+      return done(owners[0], "branch", `${branch} is a branch of ${label(owners[0])}`);
+    if (owners.length > 1)
+      return fallback(`${branch} belongs to more than one track (${owners.map((track) => track.name).join(", ")})`);
   }
-  const found = location ?? resolveStore(canonical);
-  if (found instanceof Error || !found.shared || !found.top)
-    return canonical;
-  if (real(canonical) === found.top)
-    return canonical;
-  try {
-    return fs3.realpathSync(found.top);
-  } catch {
-    return canonical;
+  const env = input.envRequested?.trim();
+  if (env) {
+    const named = tracks.find((track) => track.name === env);
+    if (named)
+      return done(named, "env", `WORKFLOW_RELEASE_TRACK selects track ${named.name}`);
+    envProblem = `WORKFLOW_RELEASE_TRACK=${env} names no release track of this workspace (${names}); ignored`;
   }
-}
-function branchRenames(location) {
-  if (!location.shared)
-    return [];
-  const files = [];
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = fs3.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
+  if (!branch)
+    return fallback("HEAD is detached");
+  if (tracks.length === 1 && !implicit)
+    return done(tracks[0], "only-track", `${tracks[0].name} is the only track`);
+  let remotes = null;
+  const short = (ref) => shortRef(ref, remotes ??= input.probe.remotes());
+  const ownerOf = (ref) => {
+    const owner = ownedBy(candidates, short(ref));
+    return owner.length === 1 ? owner[0] : null;
+  };
+  const followRecorded = (start) => {
+    let cursor = start;
+    const seen = new Set([start]);
+    for (let hop = 0;hop < MAX_RECORDED_HOPS; hop += 1) {
+      const recorded = input.probe.recordedBase(cursor);
+      if (!recorded)
+        return null;
+      const base = short(recorded);
+      const owner = ownerOf(base);
+      if (owner)
+        return owner;
+      if (ownedBy(candidates, base).length > 1 || seen.has(base))
+        return null;
+      seen.add(base);
+      cursor = base;
     }
-    for (const entry of entries)
-      if (entry.isDirectory())
-        walk(path6.join(dir, entry.name));
-      else
-        files.push(path6.join(dir, entry.name));
+    return null;
+  };
+  const recordedOwner = followRecorded(branch);
+  if (recordedOwner)
+    return done(recordedOwner, "recorded-base", `${branch} was created on ${label(recordedOwner)}'s line (recorded base)`);
+  for (const source of ["reflog", "checkout"]) {
+    const ref = source === "reflog" ? input.probe.createdFrom(branch) : input.probe.checkedOutFrom(branch);
+    if (!ref)
+      continue;
+    const owner = ownerOf(ref) ?? followRecorded(short(ref));
+    if (owner)
+      return done(owner, source, `${branch} was created from ${short(ref)} (${source === "reflog" ? "branch reflog" : "HEAD reflog"})`);
+  }
+  const forks = [];
+  for (const track of candidates)
+    for (const ref of new Set([track.integrationBranch, track.baseBranch])) {
+      const sha = input.probe.mergeBase(branch, ref);
+      if (sha)
+        forks.push({ track, ref, sha });
+    }
+  if (forks.length === 0)
+    return fallback(`no track branch could be compared with ${branch} (fetch the track branches)`);
+  const ancestry = new Map;
+  const descends = (older, newer) => {
+    if (older === newer)
+      return false;
+    const key = `${older}>${newer}`;
+    if (!ancestry.has(key))
+      ancestry.set(key, input.probe.isAncestor(older, newer));
+    return ancestry.get(key);
+  };
+  const winners = forks.filter((fork) => forks.every((other) => other.track === fork.track || descends(other.sha, fork.sha)));
+  const winningTracks = [...new Set(winners.map((fork) => fork.track))];
+  if (winningTracks.length === 1 && forks.some((fork) => fork.track !== winningTracks[0])) {
+    const win = winners[0];
+    return done(win.track, "ancestry", `${branch} forked from ${win.ref} at ${win.sha.slice(0, 12)}, after every other line's fork point`);
+  }
+  if (winningTracks.length === 1)
+    return fallback(`only ${label(winningTracks[0])} could be compared with ${branch}`);
+  const newest = forks.filter((fork) => !forks.some((other) => descends(fork.sha, other.sha)));
+  return fallback(`${branch} has the same or unrelated fork points with ${[...new Set(newest.map((fork) => `${fork.ref} (${fork.track.name === IMPLICIT ? "workspace default" : fork.track.name})`))].join(" and ")}`);
+}
+function gitTrackProbe(cwd) {
+  let remote;
+  let remotes;
+  const tip = (branch) => {
+    remote ??= pushRemoteName(cwd) ?? "origin";
+    return resolveRef(cwd, `refs/remotes/${remote}/${branch}`) ?? resolveRef(cwd, `refs/heads/${branch}`);
+  };
+  return {
+    remotes: () => remotes ??= remoteNames(cwd),
+    recordedBase: (branch) => git2(cwd, ["config", "--get", recordedBaseKey(branch)]) || null,
+    createdFrom: (branch) => {
+      const log = git2(cwd, ["reflog", "show", "--format=%gs", `refs/heads/${branch}`, "--"]);
+      const oldest = log?.split(`
+`).findLast(Boolean) ?? "";
+      const match = /^branch: Created from (\S+)$/u.exec(oldest);
+      return match && match[1] !== "HEAD" ? match[1] : null;
+    },
+    checkedOutFrom: (branch) => {
+      const own = reflog(cwd, `refs/heads/${branch}`);
+      const created = own.at(-1);
+      if (!created || created.subject !== "branch: Created from HEAD")
+        return null;
+      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp(branch)}$`, "u");
+      const entry = reflog(cwd, "HEAD").findLast((item) => item.time >= created.time && item.sha === created.sha && pattern.test(item.subject));
+      return entry ? pattern.exec(entry.subject)?.[1] ?? null : null;
+    },
+    mergeBase: (branch, trackBranch) => {
+      const base = tip(trackBranch);
+      return base && resolveRef(cwd, `refs/heads/${branch}`) ? mergeBase(cwd, base, `refs/heads/${branch}`) : null;
+    },
+    isAncestor: (ancestor, descendant) => git2(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]) !== null
+  };
+}
+function workspaceReleaseTracks(cwd) {
+  const raw = resolveRuntimeReleaseTracks(cwd);
+  return { workspace: raw?.workspace ?? null, ...readReleaseTracks(raw?.releaseTracks) };
+}
+function resolveTrackFor(cwd, options) {
+  const read = workspaceReleaseTracks(cwd);
+  if (read.error)
+    return { status: "invalid", error: read.error, issues: read.issues };
+  if (read.tracks.length === 0 && !options.track?.trim())
+    return { status: "none", issues: read.issues };
+  const branch = options.branch === undefined ? currentBranch(cwd) : options.branch;
+  const envRequested = process.env.WORKFLOW_RELEASE_TRACK?.trim() || null;
+  const input = {
+    tracks: read.tracks,
+    requested: options.track ?? null,
+    envRequested,
+    branch,
+    defaultBranch: options.defaultBranch,
+    issues: read.issues
   };
-  walk(path6.join(path6.dirname(location.dir), "logs", "refs", "heads"));
-  if (location.git)
-    files.push(path6.join(location.git.gitDir, "logs", "HEAD"));
-  const seen = new Set;
-  const renames = [];
-  for (const file of files) {
-    let text = "";
-    try {
-      text = fs3.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    for (const match of text.matchAll(/ (\d+) [+-]\d{4}\tBranch: renamed refs\/heads\/(\S+) to refs\/heads\/(\S+)/gu)) {
-      const rename = { from: match[2], to: match[3], at: Number(match[1]) };
-      const id = `${rename.at}\x00${rename.from}\x00${rename.to}`;
-      if (seen.has(id))
-        continue;
-      seen.add(id);
-      renames.push(rename);
-    }
+  let key = null;
+  if (!options.probe) {
+    const refs = git2(cwd, [
+      "for-each-ref",
+      "--format=%(refname) %(objectname)",
+      "refs/heads",
+      "refs/remotes"
+    ]) ?? "";
+    const head = git2(cwd, ["reflog", "show", "-n", "1", "--format=%H %gs", "HEAD", "--"]) ?? "";
+    const own = branch ? [
+      git2(cwd, [
+        "log",
+        "-g",
+        "-n",
+        "1",
+        "--date=unix",
+        "--format=%H %gd %gs",
+        `refs/heads/${branch}`,
+        "--"
+      ]) ?? "",
+      git2(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
+    ] : [];
+    key = createHash5("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
+    const hit = memo2.get(key);
+    if (hit)
+      return hit;
   }
-  return renames.toSorted((left, right) => left.at - right.at);
-}
-function followRenames(key, boundAt, renames) {
-  let current = key;
-  let since = Math.floor(Date.parse(boundAt) / 1000);
-  for (const rename of renames)
-    if (rename.from === current && rename.at >= since) {
-      current = rename.to;
-      since = rename.at;
-    }
-  return current;
+  const resolution = resolveReleaseTrack({ ...input, probe: options.probe ?? gitTrackProbe(cwd) });
+  if (key) {
+    if (memo2.size >= MEMO_LIMIT)
+      memo2.delete(memo2.keys().next().value);
+    memo2.set(key, resolution);
+  }
+  return resolution;
 }
-var NOT_A_REPO, gitRun = (cwd, args) => {
+var ReleaseTrackError, KNOWN_FIELDS, BRANCH_FIELDS, PLACEHOLDER, HAS_PLACEHOLDER, isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value), branchName = (value) => typeof value === "string" && value.trim() && !value.trim().startsWith("-") ? value.trim() : null, namedBranches = (entry) => [
+  ...BRANCH_FIELDS.map((field) => branchName(entry[field])),
+  ...Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : []
+].filter((name) => name !== null), literalOf = (template) => template.replace(PLACEHOLDER, "").replace(/[*/]/gu, "").trim(), trackBranches = (tracks) => [
+  ...new Set(tracks.flatMap((track) => [
+    track.productionBranch,
+    track.integrationBranch,
+    track.baseBranch,
+    track.pullRequestTarget,
+    ...track.mergeBackBranches
+  ]))
+], namingGlob = (template) => HAS_PLACEHOLDER.test(template) ? template.replace(PLACEHOLDER, "*") : `${template.replace(/\/?\*?$/u, "")}/*`, IMPLICIT = "", ownedBy = (tracks, branch) => tracks.filter((track) => [track.integrationBranch, track.productionBranch, track.baseBranch].includes(branch)), shortRef = (ref, remotes) => {
+  const bare = ref.replace(/^refs\/heads\//u, "").replace(/^refs\/remotes\/[^/]+\//u, "");
+  const remote = remotes.find((name) => bare.startsWith(`${name}/`));
+  return remote ? bare.slice(remote.length + 1) : bare;
+}, MAX_RECORDED_HOPS = 10, git2 = (cwd, args) => {
   const run = spawnSync6("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 20000,
-    killSignal: "SIGKILL",
     windowsHide: true,
-    env: {
-      ...process.env,
-      GIT_TERMINAL_PROMPT: "0",
-      GIT_OPTIONAL_LOCKS: "0",
-      LC_ALL: "C",
-      LANGUAGE: "C"
-    }
+    stdio: ["ignore", "pipe", "ignore"]
   });
-  const error = run.error;
+  return run.status === 0 ? (run.stdout ?? "").trim() : null;
+}, recordedBaseKey = (branch) => `branch.${branch}.workitBase`, escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), reflog = (cwd, ref) => (git2(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
+`).map((line) => {
+  const [sha = "", selector = "", ...subject] = line.split("\t");
   return {
-    ok: run.status === 0,
-    stdout: run.stdout ?? "",
-    stderr: error ? String(error.message) : run.stderr ?? "",
-    missing: error?.code === "ENOENT"
+    sha,
+    time: Number(/@\{(\d+)\}$/u.exec(selector)?.[1] ?? Number.NaN),
+    subject: subject.join("\t")
   };
-}, shortHash = (value) => createHash5("sha256").update(value).digest("hex").slice(0, 12), real = (file) => {
-  try {
-    return fs3.realpathSync.native(file);
-  } catch {
-    return file;
+}).filter((entry) => entry.sha && Number.isFinite(entry.time)), memo2, MEMO_LIMIT = 64;
+var init_release_tracks = __esm(() => {
+  init_rev();
+  init_config();
+  init_workspaces();
+  ReleaseTrackError = class ReleaseTrackError extends Error {
+  };
+  KNOWN_FIELDS = new Set([
+    "strategy",
+    "productionBranch",
+    "integrationBranch",
+    "naming",
+    "baseBranch",
+    "mergeBackBranches",
+    "pullRequestTarget",
+    "tagNamespace",
+    "versionSource",
+    "requiredChecks",
+    "critical"
+  ]);
+  BRANCH_FIELDS = ["productionBranch", "integrationBranch", "baseBranch", "pullRequestTarget"];
+  PLACEHOLDER = /\{[^}]*\}/gu;
+  HAS_PLACEHOLDER = /\{[^}]*\}/u;
+  memo2 = new Map;
+});
+
+// packages/workit-core/src/core/vcs-config.ts
+import fs4 from "node:fs";
+import path5 from "node:path";
+import { spawnSync as spawnSync7 } from "node:child_process";
+function vcsConfig(mode, cwd, options = {}) {
+  const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
+  const wsVcs = ws?.vcs ?? {};
+  const wsYt = ws?.youtrack ?? {};
+  const wsIssues = ws?.issues ?? {};
+  const { status: cfgStatus, path: cfgPath, config: cfg, error: cfgError } = readVcsConfig();
+  const root = vcsCwd(cwd);
+  const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
+  const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
+  const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
+  const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
+  const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
+  const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
+  let issuesProvider = null;
+  let linkOnPr = null;
+  if (provider === "github" && typeof wsIssues.provider === "string" && wsIssues.provider.toLowerCase() === "github") {
+    issuesProvider = "github";
+    linkOnPr = typeof wsIssues.link_on_pr === "boolean" ? wsIssues.link_on_pr : null;
   }
-}, DISCOVERY_ENV, isGitDir = (dir) => {
+  if (mode === "resolve") {
+    if (cfgStatus === "malformed")
+      return { ok: false, error: cfgError, configPath: cfgPath };
+    const trackResolution = resolveTrackFor(root, {
+      track: options.track,
+      ...options.branch !== undefined ? { branch: options.branch } : {},
+      defaultBranch: workspaceDefault
+    });
+    if (trackResolution.status === "invalid")
+      return { ok: false, error: trackResolution.error, configPath: workspacesPath() };
+    const releaseTrack = trackSummary(trackResolution);
+    const defaultTarget = releaseTrack?.track?.pullRequestTarget ?? workspaceDefault;
+    const baseBranch = releaseTrack?.track?.baseBranch ?? defaultTarget;
+    return {
+      ok: true,
+      workspace_name: ws?.name ?? null,
+      provider,
+      defaultTargetBranch: defaultTarget,
+      workspaceDefaultTargetBranch: workspaceDefault,
+      baseBranch,
+      releaseTrack,
+      link_issues: linkIssues,
+      youtrack_base_url: youtrackBaseUrl,
+      issues_provider: issuesProvider,
+      link_on_pr: linkOnPr
+    };
+  }
+  if (cfgStatus === "malformed") {
+    return { ok: false, error: cfgError, configPath: cfgPath };
+  }
+  if (cfgStatus === "missing" && provider === null)
+    return { ok: false, error: `vcs.json is missing: ${cfgPath}`, configPath: cfgPath };
+  if (provider === null) {
+    return {
+      ok: false,
+      error: `no vcs provider configured (set vcs.provider in ${cfgPath}, match a workspace entry, or run inside a checkout with a recognized origin remote)`,
+      configPath: cfgPath
+    };
+  }
+  const prov = cfg[provider] ?? {};
+  const out = {
+    ok: true,
+    configPath: path5.resolve(cfgPath),
+    provider,
+    defaultTargetBranch: workspaceDefault,
+    pr: cfg.pr ?? {},
+    workspace_name: ws?.name ?? null,
+    link_issues: linkIssues,
+    youtrack_base_url: youtrackBaseUrl,
+    issues_provider: issuesProvider,
+    link_on_pr: linkOnPr
+  };
+  if (provider === "gitlab") {
+    out.gitlab = {
+      host: prov.host ?? "gitlab.com",
+      apiUrl: prov.apiUrl ?? "https://gitlab.com/api/v4"
+    };
+  } else if (provider === "github") {
+    out.github = { host: prov.host ?? "github.com" };
+  }
+  return out;
+}
+var workspacesPath = () => path5.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
+  const r = spawnSync7("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  if (r.status !== 0)
+    return null;
+  const url = (r.stdout ?? "").trim();
+  if (/github\.com[:/]/.test(url))
+    return "github";
+  if (/gitlab\.com[:/]/.test(url))
+    return "gitlab";
+  return null;
+}, readVcsConfig = () => {
+  const file = vcsConfigPath();
+  let raw;
   try {
-    return fs3.statSync(path6.join(dir, "HEAD")).isFile() && fs3.statSync(path6.join(dir, "objects")).isDirectory() && fs3.statSync(path6.join(dir, "refs")).isDirectory();
+    raw = fs4.readFileSync(file, "utf8");
   } catch {
-    return false;
+    return { status: "missing", path: file, config: {} };
   }
-}, reftableRefs = (common) => {
+  let parsed;
   try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs3.readFileSync(path6.join(common, "config"), "utf8"));
+    parsed = JSON.parse(raw);
   } catch {
-    return false;
+    return { status: "malformed", path: file, config: {}, error: `${file} is not valid JSON` };
   }
-}, rebasingBranch = (gitDir) => {
-  for (const state of ["rebase-merge", "rebase-apply"]) {
-    try {
-      const ref = fs3.readFileSync(path6.join(gitDir, state, "head-name"), "utf8").trim();
-      const match = /^refs\/heads\/(.+)$/u.exec(ref);
-      if (match)
-        return match[1];
-    } catch {}
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    return { status: "valid", path: file, config: parsed };
+  }
+  return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
+}, trackSummary = (resolution) => resolution.status === "resolved" ? {
+  name: resolution.track?.name ?? null,
+  source: resolution.source,
+  detail: resolution.detail,
+  warnings: resolution.warnings,
+  track: resolution.track,
+  tracks: resolution.tracks,
+  blocking: resolution.blocking
+} : null;
+var init_vcs_config = __esm(() => {
+  init_config();
+  init_workspaces();
+  init_release_tracks();
+});
+
+// packages/workit-core/src/core/logger.ts
+import os3 from "node:os";
+import path6 from "node:path";
+var SENSITIVE_WORDS, STACK_WORDS, escapeRegExp2 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), resolveStateDir = () => {
+  const override = process.env.WORKFLOW_TOOLKIT_STATE;
+  if (override)
+    return override;
+  const home = os3.homedir();
+  if (process.env.XDG_STATE_HOME)
+    return path6.join(process.env.XDG_STATE_HOME, "workit");
+  switch (os3.platform()) {
+    case "darwin":
+      return path6.join(home, "Library", "Application Support", "workit");
+    case "win32":
+      return path6.join(process.env.LOCALAPPDATA ?? path6.join(home, "AppData", "Local"), "workit");
+    default:
+      return path6.join(process.env.HOME ?? home, ".local", "state", "workit");
   }
-  return null;
-}, checkoutSlug = (root) => {
-  let canonical = real(root);
-  if (process.platform === "win32")
-    canonical = canonical.toLowerCase();
-  const base = path6.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
-  return `${base}-${shortHash(canonical)}`;
-};
-var init_paths = __esm(() => {
-  NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
-  DISCOVERY_ENV = [
-    "GIT_DIR",
-    "GIT_COMMON_DIR",
-    "GIT_WORK_TREE",
-    "GIT_CEILING_DIRECTORIES",
-    "GIT_DISCOVERY_ACROSS_FILESYSTEM"
-  ];
+}, homePattern;
+var init_logger = __esm(() => {
+  SENSITIVE_WORDS = new Set([
+    "token",
+    "secret",
+    "password",
+    "passwd",
+    "authorization",
+    "credential",
+    "credentials",
+    "cookie",
+    "api",
+    "apikey",
+    "apitoken",
+    "accesstoken",
+    "clientsecret",
+    "refreshtoken",
+    "key",
+    "bearer",
+    "prompt",
+    "message",
+    "messages",
+    "content",
+    "body",
+    "args",
+    "argument",
+    "result",
+    "results",
+    "output",
+    "issue",
+    "description",
+    "summary",
+    "payload",
+    "script",
+    "command",
+    "text",
+    "query"
+  ]);
+  STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
+  homePattern = new RegExp(`${escapeRegExp2(os3.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
 });
 
 // packages/workit-core/src/host-session.ts
-import { createHash as createHash6 } from "node:crypto";
-import fs4 from "node:fs";
+import { createHash as createHash6, randomBytes, timingSafeEqual } from "node:crypto";
+import fs5 from "node:fs";
 import path7 from "node:path";
 function hostSessionFromEnv(env) {
   const value = (key) => env[key]?.trim() || null;
@@ -10217,7 +10357,7 @@ function migrateRepoIssued(cwd) {
     if (location instanceof Error)
       return;
     old = path7.join(location.dir, "hooks", "issued");
-    if (!fs4.existsSync(old))
+    if (!fs5.existsSync(old))
       return;
   } catch {
     return;
@@ -10225,13 +10365,18 @@ function migrateRepoIssued(cwd) {
   for (const lead of safeList(old)) {
     try {
       const from = path7.join(old, lead);
-      if (!fs4.statSync(from).isDirectory())
+      if (!fs5.statSync(from).isDirectory())
         continue;
       const to = path7.join(userIssuedRoot(), lead);
-      fs4.mkdirSync(to, { recursive: true, mode: 448 });
-      for (const id of fs4.readdirSync(from)) {
-        fs4.copyFileSync(path7.join(from, id), path7.join(to, id));
-        fs4.rmSync(path7.join(from, id), { force: true });
+      fs5.mkdirSync(to, { recursive: true, mode: 448 });
+      for (const id of fs5.readdirSync(from)) {
+        try {
+          fs5.copyFileSync(path7.join(from, id), path7.join(to, id), fs5.constants.COPYFILE_EXCL);
+        } catch (error) {
+          if (error.code !== "EEXIST")
+            throw error;
+        }
+        fs5.rmSync(path7.join(from, id), { force: true });
       }
       removeIfEmpty(from);
     } catch {}
@@ -10239,30 +10384,76 @@ function migrateRepoIssued(cwd) {
   removeIfEmpty(old);
 }
 function recordIssuedSession(cwd, lead, issued) {
+  const token = randomBytes(18).toString("base64url");
   try {
     migrateRepoIssued(cwd);
-    const dir = path7.join(userIssuedRoot(), hash(lead));
-    fs4.mkdirSync(dir, { recursive: true, mode: 448 });
     const own = hash(issued);
-    fs4.writeFileSync(path7.join(dir, own), ISSUED_SESSIONS_MARKER);
-    const entries = fs4.readdirSync(dir);
+    const tokens = path7.join(userTokenRoot(), hash(lead));
+    fs5.mkdirSync(tokens, { recursive: true, mode: 448 });
+    fs5.writeFileSync(path7.join(tokens, own), `${tokenHash(token)}
+`, { mode: 384, flag: "wx" });
+    const dir = path7.join(userIssuedRoot(), hash(lead));
+    fs5.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs5.writeFileSync(path7.join(dir, own), `${ISSUED_SESSIONS_MARKER}
+`, { mode: 384 });
+    pruneIssued(dir, own, tokens);
+    return token;
+  } catch {
+    return null;
+  }
+}
+function pruneIssued(dir, own, tokens) {
+  try {
+    const entries = fs5.readdirSync(dir);
     if (entries.length <= ISSUED_PER_LEAD)
       return;
-    const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs4.statSync(path7.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
-    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD))
-      fs4.rmSync(path7.join(dir, name), { force: true });
+    const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs5.statSync(path7.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
+    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD)) {
+      fs5.rmSync(path7.join(dir, name), { force: true });
+      fs5.rmSync(path7.join(tokens, name), { force: true });
+    }
   } catch {}
 }
-var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, ISSUED_PER_LEAD = 64, ISSUED_SESSIONS_MARKER = "workit-issued-sessions/2", hash = (value) => createHash6("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path7.join(resolveStateDir(), "issued"), safeList = (dir) => {
+function issuedBinding(cwd, claimed) {
+  const record = issuedRecord(cwd, claimed);
+  const { stored, leadBound } = issuedToken(claimed);
+  if (stored)
+    return "token";
+  if (record === null)
+    return null;
+  return leadBound ? "token" : "legacy";
+}
+var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, ISSUED_PER_LEAD = 64, ISSUED_SESSIONS_MARKER = "workit-issued-sessions/3", hash = (value) => createHash6("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path7.join(resolveStateDir(), "issued"), userTokenRoot = () => path7.join(resolveStateDir(), "issued-tokens"), safeList = (dir) => {
   try {
-    return fs4.readdirSync(dir);
+    return fs5.readdirSync(dir);
   } catch {
     return [];
   }
 }, removeIfEmpty = (dir) => {
   try {
-    fs4.rmdirSync(dir);
+    fs5.rmdirSync(dir);
   } catch {}
+}, tokenHash = (token) => createHash6("sha256").update(token).digest("hex"), issuedRecord = (cwd, claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return null;
+  migrateRepoIssued(cwd);
+  try {
+    return fs5.readFileSync(path7.join(userIssuedRoot(), hash(claimed.slice(0, cut)), hash(claimed)), "utf8");
+  } catch {
+    return null;
+  }
+}, TOKEN_HASH, issuedToken = (claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return { stored: null, leadBound: false };
+  const dir = path7.join(userTokenRoot(), hash(claimed.slice(0, cut)));
+  try {
+    const text = fs5.readFileSync(path7.join(dir, hash(claimed)), "utf8");
+    return { stored: TOKEN_HASH.exec(text)?.[1] ?? null, leadBound: true };
+  } catch {
+    return { stored: null, leadBound: safeList(dir).length > 0 };
+  }
 }, OWN_CHILD_SHELL;
 var init_host_session = __esm(() => {
   init_logger();
@@ -10275,13 +10466,14 @@ var init_host_session = __esm(() => {
       (env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
     ]
   ];
+  TOKEN_HASH = /^([0-9a-f]{64})$/mu;
   OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
 });
 
 // packages/workit-core/src/ledger.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
-import { createHash as createHash7, randomBytes } from "node:crypto";
-import fs5 from "node:fs";
+import { spawnSync as spawnSync8 } from "node:child_process";
+import { createHash as createHash7, randomBytes as randomBytes2 } from "node:crypto";
+import fs6 from "node:fs";
 import path8 from "node:path";
 function resolveCommit(cwd, ref) {
   if (!safeRef(ref))
@@ -10357,7 +10549,7 @@ function ledgerPath(cwd) {
   const root = storeRoot(cwd);
   return root.ok ? { ok: true, value: path8.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
-function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
+function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
   const lock = `${file}.lock`;
   const deadline = Date.now() + waitMs;
   let token = null;
@@ -10381,13 +10573,15 @@ function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
 }
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs5.openSync(file, "a+");
+    const fd = fs6.openSync(file, "a+", 384);
     try {
-      const size = fs5.fstatSync(fd).size;
+      if (process.platform !== "win32")
+        tighten(fd);
+      const size = fs6.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
         const last = Buffer.alloc(1);
-        fs5.readSync(fd, last, 0, 1, size - 1);
+        fs6.readSync(fd, last, 0, 1, size - 1);
         if (last[0] !== 10)
           fence = `
 `;
@@ -10396,16 +10590,16 @@ function appendLine(file, build, options) {
       if (!line.ok)
         return line;
       const bytes = Buffer.from(fence + line.value);
-      const written = fs5.writeSync(fd, bytes);
+      const written = fs6.writeSync(fd, bytes);
       if (written !== bytes.length)
         return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
       return { ok: true, value: undefined };
     } finally {
-      fs5.closeSync(fd);
+      fs6.closeSync(fd);
     }
   };
   try {
-    fs5.mkdirSync(path8.dirname(file), { recursive: true });
+    fs6.mkdirSync(path8.dirname(file), { recursive: true });
     if (!options.forceLock && !onNetworkFs(path8.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
@@ -10459,8 +10653,10 @@ function readLedger(cwd, options = {}) {
   if (!file.ok)
     return file;
   let text = "";
+  let stat = null;
   try {
-    text = fs5.readFileSync(file.value, "utf8");
+    stat = fs6.statSync(file.value);
+    text = fs6.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return {
@@ -10479,6 +10675,7 @@ function readLedger(cwd, options = {}) {
   const integrity = { chained: 0, legacy: 0, unverified: [] };
   const earlier = new Set([null]);
   let chainStarted = false;
+  const ids = new Set;
   for (const raw of text.split(`
 `)) {
     const trimmed = raw.trim();
@@ -10512,6 +10709,10 @@ function readLedger(cwd, options = {}) {
       reason = "unsigned";
     else
       rowIntegrity = "legacy";
+    if (options.integrity && !reason && ids.has(parsed.id))
+      reason = "duplicate_id";
+    if (options.integrity)
+      ids.add(parsed.id);
     if (reason)
       rowIntegrity = "unverified";
     const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
@@ -10535,7 +10736,8 @@ function readLedger(cwd, options = {}) {
       seq: rows.length + 1,
       superseded: false,
       supersedeIgnored: false,
-      ...rowIntegrity ? { integrity: rowIntegrity } : {}
+      ...rowIntegrity ? { integrity: rowIntegrity } : {},
+      ...reason ? { integrityReason: reason } : {}
     };
     rows.push(row);
     if (!options.integrity)
@@ -10563,18 +10765,44 @@ function readLedger(cwd, options = {}) {
   const byId = new Map;
   for (const row of rows) {
     const target = row.supersedes ? byId.get(row.supersedes) : undefined;
-    if (target && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
+    if (target && row.integrity !== "unverified" && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
       target.superseded = true;
     else if (row.supersedes)
       row.supersedeIgnored = true;
     if (!byId.has(row.id))
       byId.set(row.id, row);
   }
+  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
+    tamperCache.set(file.value, {
+      size: stat.size,
+      stamp: fileStamp(stat),
+      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason))
+    });
   return {
     ok: true,
     value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
   };
 }
+function ledgerTampering(cwd) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return [];
+  try {
+    const stat = fs6.statSync(file.value);
+    const cached = tamperCache.get(file.value);
+    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
+      return cached.breaks;
+  } catch {
+    return [];
+  }
+  const read = readLedger(cwd, { integrity: true });
+  return read.ok ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason)) : [];
+}
+function tamperedUnblock(cwd) {
+  const file = ledgerPath(cwd);
+  const where = file.ok ? file.value : "the ledger file";
+  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
+}
 function verdictBasis(verdict, current) {
   if (verdict.head && verdict.head === current.head)
     return "fresh";
@@ -10641,15 +10869,51 @@ function authorSessions(cwd, rows, branch, range = { base: null, head: null }, s
     sessions.add(session);
   return sessions;
 }
-function effectiveOf(rows, authors, sameCode, isCurrent) {
+function sessionTrust(cwd, row) {
+  const session = row.actor.session;
+  if (!session || row.self === true)
+    return null;
+  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
+  const host = row.actor.host;
+  const issuedOnly = source === "flag" ? host !== "cli" : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
+  if (!issuedOnly)
+    return null;
+  const binding = issuedBinding(cwd, session);
+  if (binding === null)
+    return "unissued_session";
+  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
+}
+function trustReasons(cwd, row) {
+  if (row.integrity === "unverified")
+    return [row.integrityReason ?? "unsigned"];
+  if (row.integrity !== "verified")
+    return ["unsigned"];
+  const session = sessionTrust(cwd, row);
+  return session ? [session] : [];
+}
+function withIntegrity(cwd, rows) {
+  if (rows.every((row) => row.integrity !== undefined))
+    return rows;
+  const read = readLedger(cwd, { integrity: true });
+  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
+  return rows.map((row) => {
+    if (row.integrity !== undefined)
+      return row;
+    const fresh = bySeq.get(row.seq);
+    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+  });
+}
+function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
   let effective = null;
   for (const row of rows) {
     if (!effective) {
       effective = row;
       continue;
     }
-    const rowIndependent = independenceReasons(row, authors).length === 0;
-    const effIndependent = independenceReasons(effective, authors).length === 0;
+    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective)))
+      continue;
+    const rowIndependent = reasonsOf(row).length === 0;
+    const effIndependent = reasonsOf(effective).length === 0;
     if (effIndependent && !rowIndependent && isCurrent(effective))
       continue;
     if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
@@ -10663,7 +10927,7 @@ function restackCarries(rows, branch, from, to) {
     return false;
   const edges = new Map;
   for (const row of rows)
-    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
       edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
   const seen = new Set([from]);
   const queue = [from];
@@ -10679,7 +10943,8 @@ function restackCarries(rows, branch, from, to) {
   }
   return false;
 }
-function checkVerdicts(cwd, branch, rows) {
+function checkVerdicts(cwd, branch, ledgerRows) {
+  const rows = withIntegrity(cwd, ledgerRows);
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const scope = branchScope(cwd, branch);
@@ -10709,21 +10974,47 @@ function checkVerdicts(cwd, branch, rows) {
     return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
+  const failureAuthorCache = new Map;
+  const failureAuthors = (row) => {
+    let set = failureAuthorCache.get(row.seq);
+    if (!set) {
+      set = authorSessions(cwd, rows.filter((other) => other.integrity === "verified" && other.seq < row.seq), branch, { base: null, head: null }, scope);
+      failureAuthorCache.set(row.seq, set);
+    }
+    return set;
+  };
+  const reasonCache = new Map;
+  const reasonsOf = (row) => {
+    let reasons = reasonCache.get(row);
+    if (!reasons) {
+      const failing = FAILING.has(String(row.result));
+      reasons = [
+        ...trustReasons(cwd, row),
+        ...independenceReasons(row, failing ? failureAuthors(row) : authors)
+      ];
+      reasonCache.set(row, reasons);
+    }
+    return reasons;
+  };
+  const retired = new Set;
+  for (const row of rows)
+    if (row.type === "verdict" && row.supersedes && !row.supersedeIgnored && trustReasons(cwd, row).length === 0)
+      retired.add(row.supersedes);
   const byKind = new Map;
   for (const row of rows)
-    if (isLiveVerdict(row) && scope(row)) {
+    if (isLiveVerdict(row, retired) && scope(row)) {
       const kind = typeof row.kind === "string" ? row.kind : "review";
       byKind.set(kind, [...byKind.get(kind) ?? [], row]);
     }
   const verdicts = [];
   const warnings = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors, sameCode, (candidate) => basisOf(candidate) !== "stale");
+    const row = effectiveOf(list, reasonsOf, sameCode, (candidate) => basisOf(candidate) !== "stale");
     if (!row)
       continue;
     const basis = basisOf(row);
     const current = basis !== "stale";
-    const independence = independenceReasons(row, authors);
+    const independence = reasonsOf(row);
     const reasons = [
       ...current ? [] : ["stale"],
       ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
@@ -10740,23 +11031,31 @@ function checkVerdicts(cwd, branch, rows) {
     });
     if (reasons.length === 0) {
       for (const later of list)
-        if (later.seq > row.seq && independenceReasons(later, authors).length > 0 && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
+        if (later.seq > row.seq && reasonsOf(later).length > 0 && !untrusted(reasonsOf(later)) && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
           warnings.push(`the author's own (self) ${String(later.result)} ${kind} verdict ${later.id} by ${later.actor.session ?? "no session"} on the current code is newer than the accepted pass ${row.id}: read it before merging`);
     }
   }
   for (const row of rows)
     if (row.integrity === "unverified" && scope(row))
       warnings.push(`ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`);
+  const tampered = ledgerTampering(cwd);
+  if (tampered.length) {
+    warnings.push(tamperedWarning(cwd, tampered));
+    for (const entry of verdicts) {
+      entry.accepted = false;
+      entry.reasons = [...entry.reasons, "ledger_tampered"];
+    }
+  }
   verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
-  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
   return {
     branch,
     head,
@@ -10777,7 +11076,7 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, PASSING, FAILING, STRONG_RESULTS,
   error,
   ...unblock ? { unblock } : {}
 }), gitRun2 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync7("git", args, {
+  const run = spawnSync8("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -10811,24 +11110,24 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, PASSING, FAILING, STRONG_RESULTS,
   } catch {
     return null;
   }
-}, newId2 = () => `${Date.now().toString(36)}-${randomBytes(6).toString("hex")}`, NETWORK_FS_TYPES, isNetworkFsType = (type) => NETWORK_FS_TYPES.has(type >>> 0), onNetworkFs = (dir) => {
+}, newId2 = () => `${Date.now().toString(36)}-${randomBytes2(6).toString("hex")}`, NETWORK_FS_TYPES, isNetworkFsType = (type) => NETWORK_FS_TYPES.has(type >>> 0), onNetworkFs = (dir) => {
   if (process.platform !== "linux")
     return false;
   try {
-    return isNetworkFsType(fs5.statfsSync(dir).type);
+    return isNetworkFsType(fs6.statfsSync(dir).type);
   } catch {
     return false;
   }
 }, LOCK_WAIT_MS = 5000, LOCK_STALE_MS = 30000, LOCK_OWNER = "owner", lockToken = (lock) => {
   try {
-    return fs5.readFileSync(path8.join(lock, LOCK_OWNER), "utf8");
+    return fs6.readFileSync(path8.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 }, lockAgeMs = (lock) => {
   for (const target of [path8.join(lock, LOCK_OWNER), lock]) {
     try {
-      return Date.now() - fs5.statSync(target).mtimeMs;
+      return Date.now() - fs6.statSync(target).mtimeMs;
     } catch {}
   }
   return null;
@@ -10836,7 +11135,7 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, PASSING, FAILING, STRONG_RESULTS,
 ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
   for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
     const buffer = Buffer.alloc(span);
-    fs5.readSync(fd, buffer, 0, span, size - span);
+    fs6.readSync(fd, buffer, 0, span, size - span);
     const end = buffer.lastIndexOf(10);
     if (end < 0) {
       if (span === size)
@@ -10864,6 +11163,11 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
       return text || null;
   }
   return null;
+}, tighten = (fd) => {
+  try {
+    if ((fs6.fstatSync(fd).mode & 63) !== 0)
+      fs6.fchmodSync(fd, 384);
+  } catch {}
 }, sealed = (row, id, at, previous) => {
   const { prevHash: _prev, rowHash: _row, ...fields } = row;
   const prevHash = previous === null ? null : sha2562(previous);
@@ -10878,7 +11182,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
     session: str(actor.session),
     agentId: str(actor.agentId)
   };
-}, isLiveVerdict = (row) => row.type === "verdict" && typeof row.result === "string" && !row.superseded, RENAMED, renameAwareBranch = (scopeOf, branch) => {
+}, TAMPER_REASONS, tamperCache, fileStamp = (stat) => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`, tamperedWarning = (cwd, breaks) => `the ledger was edited, or a row was removed or moved (${breaks.slice(0, 3).map((row) => `${row.reason} at row ${row.seq}`).join(", ")}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`, isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id), RENAMED, renameAwareBranch = (scopeOf, branch) => {
   return (target) => {
     const own = typeof branch === "string" ? branch : null;
     const theirs = typeof target.branch === "string" ? target.branch : null;
@@ -10895,7 +11199,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
     if (derivesFrom(author, session) || derivesFrom(session, author))
       return true;
   return false;
-}, independenceReasons = (row, authors) => {
+}, TRUST_REASONS, SHELL_VOUCHED_HOSTS, untrusted = (reasons) => reasons.some((reason) => TRUST_REASONS.has(reason)), independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
     reasons.push("no_session");
@@ -10906,6 +11210,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
   return reasons;
 }, OBSERVED_ONLY;
 var init_ledger = __esm(() => {
+  init_store_lock();
   init_vcs_config();
   init_rev();
   init_host_session();
@@ -10929,56 +11234,73 @@ var init_ledger = __esm(() => {
   ledgerLock = {
     acquire(lock) {
       try {
-        fs5.mkdirSync(lock);
+        fs6.mkdirSync(lock);
       } catch (error) {
         if (error.code === "EEXIST")
           return null;
         throw error;
       }
-      const token = `${process.pid}-${randomBytes(8).toString("hex")}`;
-      fs5.writeFileSync(path8.join(lock, LOCK_OWNER), token);
+      const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
+      fs6.writeFileSync(path8.join(lock, LOCK_OWNER), token);
       return token;
     },
     release(lock, token) {
       if (lockToken(lock) !== token)
         return false;
-      const tomb = `${lock}.release-${randomBytes(6).toString("hex")}`;
+      const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
       try {
-        fs5.renameSync(lock, tomb);
+        fs6.renameSync(lock, tomb);
       } catch {
         return false;
       }
       if (lockToken(tomb) !== token) {
         try {
-          fs5.renameSync(tomb, lock);
+          fs6.renameSync(tomb, lock);
         } catch {}
         return false;
       }
-      fs5.rmSync(tomb, { recursive: true, force: true });
+      fs6.rmSync(tomb, { recursive: true, force: true });
       return true;
     },
     token: lockToken,
     reap(lock, observed) {
-      const tomb = `${lock}.reap-${randomBytes(6).toString("hex")}`;
+      const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
       try {
-        fs5.renameSync(lock, tomb);
+        fs6.renameSync(lock, tomb);
       } catch {
         return false;
       }
       if (lockToken(tomb) === observed) {
-        fs5.rmSync(tomb, { recursive: true, force: true });
+        fs6.rmSync(tomb, { recursive: true, force: true });
         return true;
       }
       try {
-        fs5.renameSync(tomb, lock);
+        fs6.renameSync(tomb, lock);
       } catch {
-        fs5.rmSync(tomb, { recursive: true, force: true });
+        fs6.rmSync(tomb, { recursive: true, force: true });
       }
       return false;
     }
   };
   TAIL_BYTES = 64 * 1024;
+  TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+  tamperCache = new Map;
   RENAMED = /^branch: renamed refs\/heads\/(.+) to refs\/heads\/(.+)$/iu;
+  TRUST_REASONS = new Set([
+    "unsigned",
+    "hash_mismatch",
+    "broken_link",
+    "duplicate_id",
+    "unissued_session",
+    "unbound_session"
+  ]);
+  SHELL_VOUCHED_HOSTS = new Set([
+    "cli",
+    "opencode",
+    "pi",
+    "codex_cli",
+    "codex_desktop"
+  ]);
   OBSERVED_ONLY = new Set([
     "check",
     "merge.unverified",
@@ -11928,7 +12250,7 @@ function normalizeMaxBytes(value, options = {}) {
 }
 
 // node_modules/@openclaw/fs-safe/dist/bounded-read.js
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 function createScratchBuffer(maxBytes) {
   const initialReadBytes = Number.isFinite(maxBytes) ? Math.min(READ_CHUNK_BYTES, maxBytes + 1) : READ_CHUNK_BYTES;
   return Buffer.allocUnsafe(Math.max(1, initialReadBytes));
@@ -11951,7 +12273,7 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
   let total = 0;
   while (true) {
     const length = nextReadLength(total, maxBytes, scratch.length);
-    const bytesRead = fs6.readSync(fd, scratch, 0, length, null);
+    const bytesRead = fs7.readSync(fd, scratch, 0, length, null);
     if (bytesRead === 0) {
       return Buffer.concat(chunks, total);
     }
@@ -11965,9 +12287,9 @@ var init_bounded_read = __esm(() => {
 });
 
 // node_modules/@openclaw/fs-safe/dist/read-open-flags.js
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 function resolveReadOpenFlags(options) {
-  const constants = options?.constants ?? fs7.constants;
+  const constants = options?.constants ?? fs8.constants;
   const noFollow = process.platform !== "win32" && options?.followSymlinks !== true && typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
   const nonBlocking = process.platform !== "win32" && typeof constants.O_NONBLOCK === "number" ? constants.O_NONBLOCK : 0;
   return constants.O_RDONLY | noFollow | nonBlocking;
@@ -11975,7 +12297,7 @@ function resolveReadOpenFlags(options) {
 var init_read_open_flags = () => {};
 
 // node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { randomBytes as randomBytes3 } from "node:crypto";
 import fsSync from "node:fs";
 import path11 from "node:path";
 function parseSidecarLockSnapshot(snapshot, parser) {
@@ -11983,7 +12305,7 @@ function parseSidecarLockSnapshot(snapshot, parser) {
 }
 function createSidecarLockOwnershipToken() {
   let token = SIDECAR_LOCK_OWNERSHIP_TOKEN_PREFIX;
-  for (const byte of randomBytes2(SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES)) {
+  for (const byte of randomBytes3(SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES)) {
     for (let bit = 7;bit >= 0; bit -= 1) {
       token += byte & 1 << bit ? "\t" : " ";
     }
@@ -12180,7 +12502,7 @@ function sleepSync(ms) {
 }
 
 // node_modules/@openclaw/fs-safe/dist/file-lock-sync.js
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 import path12 from "node:path";
 function getSyncHeldLocks() {
   const globalWithState = globalThis;
@@ -12198,7 +12520,7 @@ function releaseAllSyncHeldLocks() {
     }
     try {
       if (held.fd !== undefined)
-        fs8.closeSync(held.fd);
+        fs9.closeSync(held.fd);
     } catch {}
     try {
       removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
@@ -12233,7 +12555,7 @@ function releaseSyncHeldLock(held) {
   if (held.fd !== undefined) {
     const fd = held.fd;
     held.fd = undefined;
-    fs8.closeSync(fd);
+    fs9.closeSync(fd);
   }
   removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
   heldLocks.delete(held.normalizedTargetPath);
@@ -12256,11 +12578,11 @@ function createSyncHeldLockHandle(held) {
   };
 }
 function canonicalLockParentSync(parent) {
-  return process.platform === "win32" ? fs8.realpathSync.native(parent) : fs8.realpathSync(parent);
+  return process.platform === "win32" ? fs9.realpathSync.native(parent) : fs9.realpathSync(parent);
 }
 function normalizeTargetPath(targetPath) {
   const resolved = path12.resolve(targetPath);
-  fs8.mkdirSync(path12.dirname(resolved), { recursive: true });
+  fs9.mkdirSync(path12.dirname(resolved), { recursive: true });
   try {
     return path12.join(canonicalLockParentSync(path12.dirname(resolved)), path12.basename(resolved));
   } catch {
@@ -12288,7 +12610,7 @@ function defaultShouldReclaim(snapshot, staleMs, nowMs) {
 }
 function reclaimGuardExists(reclaimGuardPath) {
   try {
-    fs8.lstatSync(reclaimGuardPath);
+    fs9.lstatSync(reclaimGuardPath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT")
@@ -12352,19 +12674,19 @@ function acquireFileLockSync(targetPath, options) {
     const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
     let lockFileCreateDenied = false;
     try {
-      const noFollow = process.platform !== "win32" && typeof fs8.constants.O_NOFOLLOW === "number" ? fs8.constants.O_NOFOLLOW : 0;
+      const noFollow = process.platform !== "win32" && typeof fs9.constants.O_NOFOLLOW === "number" ? fs9.constants.O_NOFOLLOW : 0;
       try {
-        fd = fs8.openSync(lockPath, fs8.constants.O_WRONLY | fs8.constants.O_CREAT | fs8.constants.O_EXCL | noFollow, 384);
+        fd = fs9.openSync(lockPath, fs9.constants.O_WRONLY | fs9.constants.O_CREAT | fs9.constants.O_EXCL | noFollow, 384);
       } catch (error) {
         lockFileCreateDenied = isTransientLockFileDenial(error, lockPath);
         throw error;
       }
-      fs8.writeFileSync(fd, raw, "utf8");
-      fs8.fsyncSync(fd);
+      fs9.writeFileSync(fd, raw, "utf8");
+      fs9.fsyncSync(fd);
       const snapshot = {
         raw,
         payload,
-        stat: fs8.fstatSync(fd),
+        stat: fs9.fstatSync(fd),
         ownershipToken
       };
       const createdHeld = {
@@ -12399,8 +12721,8 @@ function acquireFileLockSync(targetPath, options) {
       return returnedHandle;
     } catch (error) {
       if (fd !== undefined) {
-        const failed = { payload: null, stat: fs8.fstatSync(fd) };
-        fs8.closeSync(fd);
+        const failed = { payload: null, stat: fs9.fstatSync(fd) };
+        fs9.closeSync(fd);
         fd = undefined;
         removeSidecarLockIfUnchangedSync(lockPath, failed);
       }
@@ -12449,7 +12771,7 @@ function acquireFileLockSync(targetPath, options) {
         })) {
           let ownsReclaimGuard = false;
           try {
-            fs8.mkdirSync(reclaimGuardPath);
+            fs9.mkdirSync(reclaimGuardPath);
             ownsReclaimGuard = true;
             if (removeSidecarLockIfUnchangedSync(lockPath, snapshot))
               continue;
@@ -12462,7 +12784,7 @@ function acquireFileLockSync(targetPath, options) {
           } finally {
             if (ownsReclaimGuard) {
               try {
-                fs8.rmdirSync(reclaimGuardPath);
+                fs9.rmdirSync(reclaimGuardPath);
               } catch {}
             }
           }
@@ -12508,137 +12830,6 @@ var packageRoot = () => {
 };
 var init_package_root = () => {};
 
-// packages/workit-core/src/core/store-lock.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
-import fs9 from "node:fs";
-import { hostname } from "node:os";
-var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, RECLAIM_GUARD_TTL_MS = 30000, defaultLockTimeoutMs = 250, defaultLockTimeout = () => defaultLockTimeoutMs, parseMetadataLock = (raw) => {
-  let value;
-  try {
-    value = JSON.parse(raw);
-  } catch {
-    throw Object.assign(new Error("metadata lock is invalid"), { code: "metadata_lock_invalid" });
-  }
-  const parsed = metadataLockSchema.safeParse(value);
-  if (!parsed.success)
-    throw Object.assign(new Error("metadata lock is invalid"), { code: "metadata_lock_invalid" });
-  return parsed.data;
-}, parseMetadataLockOrNull = (raw) => {
-  try {
-    return parseMetadataLock(raw);
-  } catch {
-    return null;
-  }
-}, parseProcStatStart = (stat) => {
-  const close = stat.lastIndexOf(")");
-  if (close < 0)
-    return null;
-  return stat.slice(close + 1).trim().split(/\s+/)[19] ?? null;
-}, processStartOf = (pid) => {
-  if (process.platform === "linux") {
-    try {
-      return parseProcStatStart(fs9.readFileSync(`/proc/${pid}/stat`, "utf8"));
-    } catch {
-      return null;
-    }
-  }
-  if (process.platform === "darwin" || process.platform === "freebsd") {
-    try {
-      const run = spawnSync8("ps", ["-o", "lstart=", "-p", String(pid)], {
-        encoding: "utf8",
-        timeout: 1000
-      });
-      const value = run.status === 0 ? run.stdout.trim() : "";
-      return value || null;
-    } catch {
-      return null;
-    }
-  }
-  return null;
-}, readTrimmed = (file) => {
-  try {
-    return fs9.readFileSync(file, "utf8").trim() || null;
-  } catch {
-    return null;
-  }
-}, cachedLockHost = null, localLockHost = () => {
-  if (cachedLockHost !== null)
-    return cachedLockHost;
-  let pidns = null;
-  try {
-    pidns = /\[(\d+)\]/.exec(fs9.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
-  } catch {}
-  const boot = readTrimmed("/proc/sys/kernel/random/boot_id");
-  cachedLockHost = pidns || boot ? `${hostname()}#${pidns ?? "?"}:${boot ?? "?"}` : hostname();
-  return cachedLockHost;
-}, pidAlive = (pid) => {
-  if (!Number.isSafeInteger(pid) || pid <= 0)
-    return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-}, TASK_STORE_LOCK, classifyLockOwner = (payload, ageMs, localHost = localLockHost(), options = {}) => {
-  const lock = metadataLockSchema.safeParse(payload);
-  if (!lock.success)
-    return ageMs !== null && ageMs > UNREADABLE_LOCK_TTL_MS ? { state: "stale", reason: "unreadable lock left behind" } : { state: "unknown", reason: "lock is being written" };
-  const { pid, processStart, host } = lock.data;
-  const [lockName, lockSpace] = host.split("#");
-  const [localName, localSpace] = localHost.split("#");
-  if (lockSpace && localSpace && lockName === localName) {
-    const [lockNs, lockBoot] = lockSpace.split(":");
-    const [localNs, localBoot] = localSpace.split(":");
-    if (lockNs === localNs && lockNs !== "?" && lockBoot !== "?" && lockBoot !== localBoot)
-      return { state: "stale", reason: "lock was taken before this machine rebooted" };
-  }
-  if (host !== localHost)
-    return ageMs !== null && ageMs > FOREIGN_LOCK_TTL_MS ? { state: "stale", reason: `lock from ${host} is older than its TTL` } : { state: "unknown", reason: `lock is held from ${host}; its pid cannot be checked here` };
-  if (!pidAlive(pid))
-    return { state: "stale", reason: `pid ${pid} is not running` };
-  const currentStart = processStartOf(pid);
-  if (processStart !== null && currentStart !== null && processStart !== currentStart)
-    return { state: "stale", reason: `pid ${pid} now belongs to a different process` };
-  if (options.reclaimUnverifiedAfterTtl === true && (processStart === null || currentStart === null) && ageMs !== null && ageMs > FOREIGN_LOCK_TTL_MS)
-    return {
-      state: "stale",
-      reason: `pid ${pid} is running but the lock is older than its TTL and the pid's start time cannot be checked (reused pid)`
-    };
-  return { state: "live", reason: `held by running pid ${pid}` };
-}, ageOf = (file, nowMs) => {
-  try {
-    return nowMs - fs9.lstatSync(file).mtimeMs;
-  } catch {
-    return null;
-  }
-}, clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
-  const guard = `${lockPath}.reclaim`;
-  const age = ageOf(guard, nowMs);
-  if (age === null || age <= RECLAIM_GUARD_TTL_MS)
-    return false;
-  try {
-    fs9.rmdirSync(guard);
-    return true;
-  } catch {
-    return false;
-  }
-};
-var init_store_lock = __esm(() => {
-  init_zod();
-  init_task_contract();
-  init_paths();
-  metadataLockSchema = object({
-    pid: number2().int().nonnegative().safe(),
-    processStart: string2().nullable(),
-    host: string2().min(1),
-    nonce: string2().min(1),
-    externalAction: literal(true).optional()
-  }).strict();
-  FOREIGN_LOCK_TTL_MS = 10 * 60000;
-  TASK_STORE_LOCK = { reclaimUnverifiedAfterTtl: true };
-});
-
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs10 from "node:fs";
@@ -15650,11 +15841,11 @@ what and whether, the CLI does how and records what it observed.
 Native host allow/ask/deny, sandbox and org rules stay authoritative. Never
 switch paths to evade a denial, never claim enforcement a host cannot provide,
 and never fabricate an approval or verdict. A question answer is not
-host permission, and imported decisions or handoffs never grant authority.
+host permission, and imported decisions or handoffs grant no authority.
 
 Autonomy contract:
 - Continue to the requested endpoint (commit, push, PR, green CI, verified,
-  merged) without asking "continue?", running checks and repairs on the way.
+  merged) without asking "continue?", running checks and repairs.
   Stop only for a new consequential choice, a host denial, a conflicting edit
   or an unresolved blocker; report open gaps and uncertain workers.
 - No endpoint named: stop at a local commit on a policy-compliant branch and
@@ -15664,7 +15855,8 @@ Autonomy contract:
   never merging; \`merged\` also lands it with \`workit pr merge\`.
   Merge and release need a workspace grant only the user raises from their
   own terminal (a blocked verb names how); never edit workspaces.json or route
-  around a grant_required.
+  around grant_required. Release: \`workit release start <v>\`, commits,
+  \`finish\`; \`publish\` if asked.
 - Ask only for a product or preference choice, or for authority you lack, with
   your recommended answer. Facts are yours: read, run or prototype.
 - Label claims measured (run and seen this session), inferred, or guess.
@@ -15679,22 +15871,22 @@ Autonomy contract:
   reconcile every requested item and observe it (\`workit verify-delivery\`).
 
 CLI first: if a step has one right answer, use the \`workit\` verb instead of
-hand-running git, gh or glab (\`workit git|pr|ci|check\`; \`workit help\` lists
-the rest; lacking \`workit\`, \`npx -y @brainervirus/workit-cli\`).
+hand-running git, gh or glab (\`workit git|pr|ci|check|help\`;
+else \`npx -y @brainervirus/workit-cli\`).
 Add Co-Authored-By via \`workit git commit --trailer "K: v" -- <paths>\`, never
 an amend.
 The task families (task, policy, evidence, finding, decision, worker, state)
 are optional continuity for tracked work; each branch has one implicit task,
-and a solo edit needs no task. A decision
-records a user choice; it never authorizes an effect. Judge work once with
+and a solo edit needs no task. A decision records a user choice; it never
+authorizes an effect. Judge work once with
 \`workit policy assess --judge risk= behavior= product-choice= plan=\`.
-Across repositories, bind each item to its checkout, branch and endpoint,
-resolve competing targets before a mutation, and reconcile an uncertain
-external effect before retrying it.
+Across repositories, bind items to checkout, branch and endpoint, resolve
+competing targets before a mutation, and reconcile an uncertain
+external effect before a retry.
 
 Mid-task: never silently drop or resume an objective (workit-continue).
 
-Skills: load the skill, never act from memory of it (slash aliases /wk-<name>).
+Skills: load the skill, never act from memory (aliases /wk-<name>).
 - brainstorm, plan, spec, grill, should we: workit-shape
 - implement, build, add a feature: workit-implement
 - review, blast radius: workit-review
@@ -19285,7 +19477,7 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
     return `workit: raw ${quote(action.via === "api" ? `${action.forge} api` : action.forge === "gh" ? "gh pr merge" : "glab mr merge")}${action.via === "api" ? " merge" : ""} bypasses the merge grant and the verdict gate. Run ${quote("workit pr merge")} instead (it checks both; ${quote("workit help pr")}).`;
   const plainPush = action.kind === "push" && !action.blindForce && !action.deletes;
   if (dir && branch && plainPush && releaseBranch(dir, branch))
-    return `workit: raw ${quote("git push")} onto ${branch}, a protected release branch, bypasses workit's protected-branch check. To finish a release or hotfix, push it with ${quote(`workit git push --release ${branch} [--release v<version>]`)}: it pushes ${branch} (fast-forward only) and the release tag, verifies the remote and records it, under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}). Feature work goes through ${quote("workit git push")} and ${quote("workit pr merge")}.`;
+    return `workit: raw ${quote("git push")} onto ${branch}, a protected release branch, bypasses workit's protected-branch check. To finish a release or hotfix, push it with ${quote(`workit git push --release ${branch} [--release ${releaseTagPrefixOf(dir)}<version>]`)}: it pushes ${branch} (fast-forward only) and the release tag, verifies the remote and records it, under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}). Feature work goes through ${quote("workit git push")} and ${quote("workit pr merge")}.`;
   return `workit: raw ${quote("git push")}${action.kind === "push" && action.blindForce ? " --force" : ""} onto ${branch}, a protected branch or the default target, bypasses workit's protected-branch check. Push your feature branch with ${quote("workit git push")} (${quote("workit git push --force-with-lease")} to rewrite it) and land it with ${quote("workit pr merge")}.`;
 }, refFacts = (repo, remote) => {
   const facts = { heads: new Set, tags: new Set, remoteHeads: new Set };
@@ -19365,15 +19557,16 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
       return bare;
   }
   return null;
-}, isTag = (facts, name) => facts.tags.has(name) && !facts.heads.has(name), tagRefusal = (action, facts) => {
+}, isTag = (facts, name) => facts.tags.has(name) && !facts.heads.has(name), tagRefusal = (action, facts, dir) => {
   const tags = [
     ...action.tags ?? [],
     ...action.targets.filter((name) => name !== null && isTag(facts, name))
   ];
   if (!tags.length && !action.allTags)
     return null;
-  const named = tags.length ? tags.join(" --release ") : "v<version>";
-  return `workit: raw ${quote(`git push${action.allTags ? " --tags" : ""}`)} of ${tags.length ? `tag ${tags.join(", ")}` : "tags"} bypasses the release grant. Push a release tag with ${quote(`workit git push --release ${named}`)} (v<version> tags whose commit the production branch already has; a tag never moves), under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}).`;
+  const shape = `${releaseTagPrefixOf(dir)}<version>`;
+  const named = tags.length ? tags.join(" --release ") : shape;
+  return `workit: raw ${quote(`git push${action.allTags ? " --tags" : ""}`)} of ${tags.length ? `tag ${tags.join(", ")}` : "tags"} bypasses the release grant. Push a release tag with ${quote(`workit git push --release ${named}`)} (${shape} tags whose commit the production branch already has; a tag never moves), under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}).`;
 }, remoteHeads = (repo, remote) => {
   const listed = spawnSync11("git", ["ls-remote", "--heads", remote], {
     cwd: repo.dir,
@@ -19435,7 +19628,7 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
     if (guarded)
       return refusal(action, guarded, repo.dir);
   }
-  return tagRefusal(pushed, facts) ?? (action.deletes ? null : offPolicyPush(pushed, repo, facts, remote));
+  return tagRefusal(pushed, facts, repo.dir) ?? (action.deletes ? null : offPolicyPush(pushed, repo, facts, remote));
 }, actionsIn = (cwd, command, dialect, cache = new Map) => {
   const out = [];
   const repos = new Map;
@@ -19539,6 +19732,7 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
 };
 var init_raw_git = __esm(() => {
   init_branch();
+  init_branch_policy();
   init_workspaces();
   init_ledger();
   init_paths();
@@ -20045,10 +20239,10 @@ function stopObligation(input, descriptor) {
     const branch = currentBranch(input.cwd);
     if (!branch || guardedBranch(input.cwd, branch))
       return null;
-    const ledger = readLedger(input.cwd);
+    const ledger = readLedger(input.cwd, { integrity: true });
     if (!ledger.ok)
       return null;
-    const all = ledger.value.rows;
+    const all = ledger.value.rows.filter((row) => row.integrity !== "unverified");
     const rows = all.filter((row) => row.branch === branch);
     const mine = rows.filter((row) => sessionOf(row) === session);
     const commits = new Set(mine.filter((row) => row.type === "commit.recorded").map((row) => typeof row.sha === "string" ? row.sha : row.head).filter((sha) => typeof sha === "string"));
@@ -20576,9 +20770,9 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
-  if (session)
-    recordIssuedSession(input.cwd || process.cwd(), session, own);
-  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> --session ${own} ...\` so the ledger tells it apart from the author.`;
+  const token = session ? recordIssuedSession(input.cwd || process.cwd(), session, own) : null;
+  const flags = token ? `--session ${own} --token ${token}` : `--session ${own}`;
+  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> ${flags} ...\` so the ledger tells it apart from the author.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 }, failureDecision = (descriptor, event, error) => {
   if (event === "shell.pre" || event === "tool.pre" || event === "write.pre")
     return descriptor.shellPolicy.failClosed ? { kind: "deny", reason: error, unblock: null } : NONE5;