@brainervirus/workit-cursor 8.13.1 → 8.14.1

package/dist/cursor-session-start.js

@@ -7624,6 +7624,16 @@ var init_zod = __esm(() => {
 
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
+function resolveIdRef(kind, ref, ids) {
+  if (ids.includes(ref))
+    return success(null, null, ref);
+  const matches = ids.filter((candidate) => candidate.startsWith(ref));
+  if (matches.length === 1)
+    return success(null, null, matches[0]);
+  if (matches.length === 0)
+    return failure2("not_found", `${kind} not found`);
+  return failure2("invalid_input", `${kind} prefix ${ref} is ambiguous; candidates: ${matches.join(", ")}`);
+}
 function parseOperation(family, input) {
   if (typeof input === "object" && input !== null && "schemaVersion" in input && input.schemaVersion !== SCHEMA_VERSION)
     return failure2("unsupported_version", "unsupported schema version", { operation: family });
@@ -7726,7 +7736,7 @@ var SCHEMA_VERSION = 1, POLICY_VERSION = "1.0.0", OPERATION_FAMILIES, uuidPatter
       return true;
   }
   return false;
-}, text, id, digest, revision, validUtc = (value) => {
+}, text, id, idRefPattern, idRef, digest, revision, validUtc = (value) => {
   const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?Z$/.exec(value);
   if (!match)
     return false;
@@ -7909,6 +7919,8 @@ var init_task_contract = __esm(() => {
       ctx.issues.push({ code: "custom", input: ctx.value, message: "invalid Unicode", path: [] });
   });
   id = text.regex(uuidPattern, "expected lowercase UUID");
+  idRefPattern = /^[0-9a-f][0-9a-f-]{7,35}$/;
+  idRef = text.regex(idRefPattern, "expected a UUID or an id prefix of 8+ characters");
   digest = text.regex(digestPattern, "expected lowercase SHA-256 digest");
   revision = text.regex(uuidPattern, "expected UUID revision");
   utcSchema = text.check((ctx) => {
@@ -8177,7 +8189,7 @@ var init_task_contract = __esm(() => {
     outcome: _enum(["completed", "failed", "cancelled"]),
     summary: text,
     evidenceIds: array(id),
-    findingIds: array(id)
+    findingIds: array(idRef)
   }).strict();
   workerSchema = object({
     assignment: assignmentSchema,
@@ -8369,7 +8381,7 @@ var init_task_contract = __esm(() => {
       action: literal("resolve"),
       ...taskId,
       expectedRevision: revision.optional(),
-      findingId: id,
+      findingId: idRef,
       disposition: _enum(["open", "fixed", "dismissed", "deferred"]),
       reason: text,
       evidenceIds: array(id),
@@ -8410,7 +8422,7 @@ var init_task_contract = __esm(() => {
       ...taskId,
       expectedRevision: revision.optional(),
       expectedWorkspaceRevision: revision.optional(),
-      workerId: id,
+      workerId: idRef,
       report: workerReportSchema
     }),
     cancel: operation({
@@ -8418,7 +8430,7 @@ var init_task_contract = __esm(() => {
       ...taskId,
       ...revisions,
       expectedWorkspaceRevision: revision.optional(),
-      workerId: id,
+      workerId: idRef,
       reason: text
     })
   };
@@ -9570,24 +9582,26 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
 }, resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
-}, workspaceTrailers = (cwd, dir) => {
+}, inheritedSetting = (cwd, dir, has) => {
   let matched;
   try {
     matched = matchRuntimeWorkspace(cwd, dir);
   } catch {
-    return { enabled: true, workspace: null, from: null };
+    return null;
   }
   if (!matched)
-    return { enabled: true, workspace: null, from: null };
+    return null;
   const { selected, matches } = matched;
   const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
-  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return { workspace: selected.name, source: [selected, ...enclosing].find(has) ?? null };
+}, workspaceTrailers = (cwd, dir) => {
+  const found = inheritedSetting(cwd, dir, (entry) => typeof entry.trailers === "boolean");
   return {
-    enabled: source?.trailers !== false,
-    workspace: selected.name,
-    from: source?.name ?? null
+    enabled: found?.source?.trailers !== false,
+    workspace: found?.workspace ?? null,
+    from: found?.source?.name ?? null
   };
-}, resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+}, workspaceLiveSessionGuard = (cwd, dir) => inheritedSetting(cwd, dir, (entry) => typeof entry.liveSessionGuard === "boolean")?.source?.liveSessionGuard !== false, TIER_KEYS, TIER_HOSTS, resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   const matched = matchRuntimeWorkspace(cwd);
   if (!matched)
     return null;
@@ -9698,6 +9712,8 @@ var init_workspaces = __esm(() => {
     defaultEndpoint: unknown().optional(),
     verification: _enum(["self", "independent"]).optional(),
     trailers: boolean2().optional(),
+    liveSessionGuard: boolean2().optional(),
+    fanout: object({ tierModels: unknown().optional() }).passthrough().optional(),
     autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
       kind,
       union([boolean2(), literal("verified")]).optional()
@@ -9747,6 +9763,17 @@ var init_workspaces = __esm(() => {
   runtimeWorkspaceIndexSchema = object({
     workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
   }).passthrough();
+  TIER_KEYS = new Set(["mundane", "standard", "hard"]);
+  TIER_HOSTS = new Set([
+    "claude_code",
+    "opencode",
+    "codex",
+    "codex_cli",
+    "codex_desktop",
+    "cursor",
+    "pi",
+    "default"
+  ]);
 });
 
 // packages/workit-core/src/core/release-tracks.ts
@@ -13447,20 +13474,26 @@ class TaskStore {
     return success(null, null, { key: key.data, bound: bound.data });
   }
   taskForWorker(workerId) {
-    if (typeof workerId !== "string" || !validId(workerId))
+    if (typeof workerId !== "string" || !idRefPattern.test(workerId))
       return failure2("invalid_input", "needs a worker id: `workit worker cancel|report <workerId>`");
     const listed = this.listTaskIndex();
     if (!listed.ok)
       return listed;
+    const owners = new Map;
     for (const entry of listed.data) {
       if (entry.status === "closed")
         continue;
       const loaded = this.load(entry.id);
       if (!loaded.ok)
         return loaded;
-      if (loaded.data?.record.workers.some((worker) => worker.id === workerId))
-        return success(null, null, entry.id);
+      for (const worker of loaded.data?.record.workers ?? [])
+        owners.set(worker.id, entry.id);
     }
+    const resolved = resolveIdRef("worker", workerId, [...owners.keys()]);
+    if (resolved.ok)
+      return success(null, null, owners.get(resolved.data) ?? null);
+    if (resolved.code !== "not_found")
+      return resolved;
     return success(null, null, null);
   }
   originTaskEntry() {
@@ -16719,6 +16752,10 @@ class WorkitCore {
     }
     if (helper?.ok)
       return failure2("permission_denied", "helpers cannot resolve findings");
+    const findingRef = resolveIdRef("finding", input.findingId, task.data.findings.map((entry) => entry.id));
+    if (!findingRef.ok)
+      return findingRef;
+    input.findingId = findingRef.data;
     const finding = task.data.findings.find((entry) => entry.id === input.findingId);
     if (!finding)
       return failure2("not_found", "finding not found");
@@ -16870,15 +16907,31 @@ class WorkitCore {
         return changed;
       return success(changed.data.task.revision, changed.data.workspace.revision, changed.data.task.workers.at(-1));
     }
+    const workerRef = resolveIdRef("worker", input.workerId, helperId === null ? task.data.workers.map((candidate) => candidate.id) : [helperId]);
+    if (!workerRef.ok)
+      return helperId === null ? workerRef : failure2("permission_denied", input.action === "report" ? ONLY_OWN_REPORT : NO_HELPER_CONTROL);
+    input.workerId = workerRef.data;
     const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
     if (!entry)
       return failure2("not_found", "worker not found");
     if (input.action === "report") {
       if (helperId === null || helperId !== input.workerId)
-        return failure2("permission_denied", "workers can submit only their own report");
+        return failure2("permission_denied", ONLY_OWN_REPORT);
       const helper = this.helperEntry(task.data, true, true);
       if (!helper.ok)
         return helper;
+      const ownFindings = task.data.findings.filter((candidate) => candidate.provenance.workerId === helperId).map((candidate) => candidate.id);
+      const reported = [];
+      for (const findingRef of input.report.findingIds) {
+        const found = resolveIdRef("finding", findingRef, ownFindings);
+        if (found.ok)
+          reported.push(found.data);
+        else if (found.code === "not_found")
+          reported.push(findingRef);
+        else
+          return found;
+      }
+      input.report.findingIds = reported;
       const evidence = task.data.evidence.filter((candidate) => input.report.evidenceIds.includes(candidate.id));
       const findings = task.data.findings.filter((candidate) => input.report.findingIds.includes(candidate.id));
       if (evidence.length !== input.report.evidenceIds.length || findings.length !== input.report.findingIds.length)
@@ -16906,7 +16959,7 @@ class WorkitCore {
       return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during report");
     }
     if (helperId !== null)
-      return failure2("permission_denied", "helpers cannot cancel or control workers");
+      return failure2("permission_denied", NO_HELPER_CONTROL);
     if (task.data.status === "closed")
       return failure2("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "stopped") {
@@ -17435,7 +17488,7 @@ var MAX_JUDGED_REFS = 5, workspaceVerification = (root) => {
     return changed;
   const updated = changed.data.task.workers.find((candidate) => candidate.id === input.workerId);
   return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during lifecycle observation");
-}, refsWithinScope = (refs, scope) => refs.every((ref) => ref.kind !== "file" || scopeCovers(scope, { description: "", paths: [ref.path], exclusions: [] })), TASK_SCOPED_ACTIONS, WORKER_ADDRESSED_ACTIONS, workerCommand = (taskId, request) => {
+}, refsWithinScope = (refs, scope) => refs.every((ref) => ref.kind !== "file" || scopeCovers(scope, { description: "", paths: [ref.path], exclusions: [] })), TASK_SCOPED_ACTIONS, ONLY_OWN_REPORT = "workers can submit only their own report", NO_HELPER_CONTROL = "helpers cannot cancel or control workers", WORKER_ADDRESSED_ACTIONS, workerCommand = (taskId, request) => {
   const { action, workerId, reason, report } = request;
   const rest = JSON.stringify({ reason, report });
   const payload = rest === "{}" ? "" : ` --payload '${rest.replace(/'/gu, "'\\''")}'`;
@@ -20052,10 +20105,238 @@ var init_policy = __esm(() => {
   init_shell_words();
 });
 
+// packages/workit-core/src/core/live-session.ts
+import { spawnSync as spawnSync13 } from "node:child_process";
+import { createHash as createHash15 } from "node:crypto";
+import fs17 from "node:fs";
+import os6 from "node:os";
+import path22 from "node:path";
+var LIVE_SESSION_TTL_MS, HEARTBEAT_EVERY_MS = 30000, liveProbe, leadOf = (session) => session.split(":")[0].replace(/-w-.*$/su, "") || session, familyOf = (host) => host.replace(/_(?:cli|desktop)$/u, ""), processAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}, processInfo = (pid) => {
+  try {
+    if (liveProbe.platform === "linux") {
+      const stat = fs17.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+      const command = fs17.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
+      return Number.isInteger(ppid) ? { ppid, command: command.trim() } : null;
+    }
+    if (liveProbe.platform === "win32")
+      return null;
+    const match = /^\s*(\d+)\s+(.*)$/su.exec(liveProbe.run(["-o", "ppid=,command=", "-p", String(pid)]));
+    return match ? { ppid: Number(match[1]), command: match[2].trim() } : null;
+  } catch {
+    return null;
+  }
+}, WRAPPER, PIDS, hostPid = (transport) => {
+  if (transport !== "hook-process")
+    return process.pid;
+  const key = `${liveProbe.platform}\x00${process.ppid}`;
+  if (PIDS.has(key))
+    return PIDS.get(key) ?? null;
+  if (liveProbe.platform === "win32") {
+    PIDS.set(key, null);
+    return null;
+  }
+  let pid = process.ppid;
+  for (let hop = 0;hop < 4; hop++) {
+    const info = processInfo(pid);
+    if (!info || !WRAPPER.test(info.command) || info.ppid <= 1)
+      break;
+    pid = info.ppid;
+  }
+  PIDS.set(key, pid);
+  return pid;
+}, sessionSafe = (value) => value.replace(/[^A-Za-z0-9_.:@/+-]/gu, "-"), liveOwner = (input, transport, env = process.env) => {
+  const session = input.session.id?.trim();
+  if (!session)
+    return null;
+  const leads = new Set([leadOf(sessionSafe(session))]);
+  if (input.session.parentId)
+    leads.add(leadOf(sessionSafe(input.session.parentId)));
+  if (env.WORKIT_PI_WORKER_SESSION && env.WORKIT_SESSION_ID)
+    leads.add(leadOf(sessionSafe(env.WORKIT_SESSION_ID)));
+  return {
+    host: input.host,
+    session: sessionSafe(session),
+    leads: [...leads],
+    pid: () => hostPid(transport)
+  };
+}, checkoutOf = (target) => {
+  let dir = path22.resolve(target);
+  while (!fs17.existsSync(dir) && path22.dirname(dir) !== dir)
+    dir = path22.dirname(dir);
+  if (fs17.existsSync(dir) && !fs17.statSync(dir).isDirectory())
+    dir = path22.dirname(dir);
+  const parts = dir.split(path22.sep);
+  const dotGit = parts.lastIndexOf(".git");
+  if (dotGit > 0)
+    dir = parts.slice(0, dotGit).join(path22.sep) || path22.sep;
+  const location = resolveStore(dir);
+  if (location instanceof Error || !location.shared || !location.top)
+    return null;
+  let top = location.top;
+  try {
+    top = fs17.realpathSync.native(top);
+  } catch {}
+  return top;
+}, markerFile2 = (top) => path22.join(resolveStateDir(), "live-sessions", `${createHash15("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`), checkoutKey = (top, platform = process.platform) => {
+  let key = path22.resolve(top);
+  try {
+    key = fs17.realpathSync.native(key);
+  } catch {}
+  return platform === "win32" ? key.replaceAll("/", "\\").toLowerCase() : key;
+}, readMarker = (file) => {
+  try {
+    const value = JSON.parse(fs17.readFileSync(file, "utf8"));
+    if (value?.version !== 1 || typeof value.session !== "string" || typeof value.host !== "string" || typeof value.heartbeatAt !== "string" || Number.isNaN(Date.parse(value.heartbeatAt)))
+      return null;
+    return {
+      version: 1,
+      session: value.session,
+      leads: Array.isArray(value.leads) ? value.leads.filter((item) => typeof item === "string") : [],
+      host: value.host,
+      pid: typeof value.pid === "number" ? value.pid : null,
+      pidStart: typeof value.pidStart === "string" ? value.pidStart : null,
+      machine: typeof value.machine === "string" ? value.machine : "",
+      checkout: typeof value.checkout === "string" ? value.checkout : "",
+      heartbeatAt: value.heartbeatAt
+    };
+  } catch {
+    return null;
+  }
+}, ageOf2 = (marker, now) => now.getTime() - Date.parse(marker.heartbeatAt), isLive = (marker, deps) => {
+  const age = ageOf2(marker, deps.now ?? new Date);
+  if (age > (deps.ttlMs ?? LIVE_SESSION_TTL_MS))
+    return false;
+  if (marker.machine !== (deps.machine ?? os6.hostname()) || marker.pid === null)
+    return true;
+  if (!(deps.alive ?? processAlive)(marker.pid))
+    return false;
+  if (marker.pidStart === null)
+    return true;
+  const start = liveProbe.start(marker.pid);
+  return start === null || start === marker.pidStart;
+}, sameLead = (marker, owner) => marker.session === owner.session || owner.leads.some((lead) => lead === marker.session || marker.leads.includes(lead)), sameOwner = (marker, owner, machine) => {
+  if (sameLead(marker, owner))
+    return true;
+  if (marker.machine !== machine)
+    return false;
+  const pid = owner.pid();
+  if (pid === null || marker.pid === null || marker.pidStart === null)
+    return familyOf(marker.host) === familyOf(owner.host);
+  return marker.pid === pid;
+}, liveConflict = (target, owner, deps = {}) => {
+  try {
+    const checkout = checkoutOf(target);
+    if (!checkout)
+      return null;
+    const file = markerFile2(checkout);
+    const marker = readMarker(file);
+    if (!marker || sameLead(marker, owner) || !isLive(marker, deps))
+      return null;
+    if (sameOwner(marker, owner, deps.machine ?? os6.hostname()))
+      return null;
+    return { marker, file, ageMs: ageOf2(marker, deps.now ?? new Date), checkout };
+  } catch {
+    return null;
+  }
+}, claimLiveSession = (target, owner, deps = {}) => {
+  try {
+    const checkout = checkoutOf(target);
+    if (!checkout)
+      return;
+    const file = markerFile2(checkout);
+    const now = deps.now ?? new Date;
+    const machine = deps.machine ?? os6.hostname();
+    const current = readMarker(file);
+    if (current) {
+      const age = ageOf2(current, now);
+      if (sameLead(current, owner) && age >= 0 && age < HEARTBEAT_EVERY_MS)
+        return;
+      if (!sameLead(current, owner) && isLive(current, deps) && !sameOwner(current, owner, machine))
+        return;
+    }
+    const pid = owner.pid();
+    const marker = {
+      version: 1,
+      session: owner.session,
+      leads: owner.leads,
+      host: owner.host,
+      pid,
+      pidStart: pid === null ? null : liveProbe.start(pid),
+      machine,
+      checkout,
+      heartbeatAt: now.toISOString()
+    };
+    fs17.mkdirSync(path22.dirname(file), { recursive: true });
+    const temp = `${file}.${process.pid}.tmp`;
+    fs17.writeFileSync(temp, JSON.stringify(marker));
+    fs17.renameSync(temp, file);
+  } catch {}
+};
+var init_live_session = __esm(() => {
+  init_paths();
+  init_logger();
+  init_store_lock();
+  LIVE_SESSION_TTL_MS = 15 * 60000;
+  liveProbe = {
+    platform: process.platform,
+    run: (args) => spawnSync13("ps", args, { encoding: "utf8", timeout: 2000 }).stdout ?? "",
+    start: (pid) => processStartOf(pid)
+  };
+  WRAPPER = /^(?:\S*\/)?(?:sh|bash|dash|zsh|ash|ksh|fish|env|timeout|npx|npm|bunx|cmd\.exe|pwsh|powershell)(?:\s|$)|launch\.mjs|npx-cli\.js/u;
+  PIDS = new Map;
+});
+
 // packages/workit-core/src/hooks/write-gate.ts
 import { realpathSync as realpathSync5 } from "node:fs";
-import path22 from "node:path";
-function writeGate(cwd, paths) {
+import os7 from "node:os";
+import path23 from "node:path";
+function writeGate(cwd, paths, owner, deps) {
+  if (!owner)
+    return beforeWriteGate(cwd, paths);
+  const targets = liveTargets(cwd, paths);
+  const live = liveGate(owner, targets, deps);
+  if (live.kind !== "none")
+    return live;
+  const decision = beforeWriteGate(cwd, paths);
+  if (decision.kind === "none")
+    claimAll(owner, targets, deps);
+  return decision;
+}
+function shellGate(cwd, command, owner, dialect = "posix", deps) {
+  const writes = shellWrites(command);
+  let targets = [];
+  if (owner) {
+    try {
+      targets = [
+        ...segmentTargets(cwd, command, dialect),
+        ...gitMutationDirs(cwd, command, dialect).map((dir) => path23.join(dir, DIR_TARGET))
+      ];
+    } catch {
+      targets = [];
+    }
+  }
+  if (owner && targets.length) {
+    const live = liveGate(owner, targets, deps);
+    if (live.kind !== "none") {
+      if (!overridden(command, dialect))
+        return live;
+      noteOverride(cwd, owner, command);
+    }
+  }
+  const decision = writes.writes ? beforeWriteGate(cwd, writes.targets) : NONE3;
+  if (owner && targets.length && decision.kind === "none")
+    claimAll(owner, targets, deps);
+  return decision;
+}
+function beforeWriteGate(cwd, paths) {
   try {
     const gate = gateFor(cwd);
     if (!gate || gate.blockers.length === 0)
@@ -20074,21 +20355,21 @@ function writeGate(cwd, paths) {
 }
 var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
   let rest = "";
-  for (let dir = path22.resolve(file);; dir = path22.dirname(dir)) {
+  for (let dir = path23.resolve(file);; dir = path23.dirname(dir)) {
     try {
-      return path22.join(realpathSync5(dir), rest);
+      return path23.join(realpathSync5(dir), rest);
     } catch {
-      if (path22.dirname(dir) === dir)
-        return path22.resolve(file);
-      rest = rest ? path22.join(path22.basename(dir), rest) : path22.basename(dir);
+      if (path23.dirname(dir) === dir)
+        return path23.resolve(file);
+      rest = rest ? path23.join(path23.basename(dir), rest) : path23.basename(dir);
     }
   }
 }, exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path22.relative(fold(canonical2(root)), fold(canonical2(path22.resolve(cwd, file))));
-  if (relative.startsWith("..") || path22.isAbsolute(relative))
+  const relative = path23.relative(fold(canonical2(root)), fold(canonical2(path23.resolve(cwd, file))));
+  if (relative.startsWith("..") || path23.isAbsolute(relative))
     return true;
-  const posix = relative.split(path22.sep).join("/");
+  const posix = relative.split(path23.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 }, PREFIXES2, operands = (words) => words.filter((item) => !item.startsWith("-")), editsOf = (input) => {
@@ -20180,7 +20461,7 @@ var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
   if (!unknown && targets.length === 0)
     return { writes: false, targets: null };
   return { writes: true, targets: unknown ? null : targets };
-}, cache2, planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path22.resolve(root, file)) ?? "-").join("\x00"), gateFor = (cwd) => {
+}, cache2, planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path23.resolve(root, file)) ?? "-").join("\x00"), gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
   if (!listed.ok)
@@ -20216,21 +20497,182 @@ var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
   if (cache2.size > 32)
     cache2.delete(cache2.keys().next().value);
   return gate;
+}, MUTATING_GIT, DRY_N, MUTATING_WORKIT_GIT, DIR_TARGET = ".workit-live-target", OVERRIDE = "WORKIT_LIVE_SESSION=override", inert = (args, sub) => args.some((arg) => arg === "--help" || arg === "-h" || arg === "--dry-run" || DRY_N.has(sub) && /^-[a-zA-Z]*n[a-zA-Z]*$/.test(arg) && !arg.startsWith("--")), gitMutationDirs = (cwd, command, dialect) => {
+  let invocations;
+  try {
+    invocations = rawInvocations(command, dialect);
+  } catch {
+    return [];
+  }
+  return invocations.flatMap((invocation) => {
+    if (invocation.tool !== "git" || invocation.dir === undefined)
+      return [];
+    const at = invocation.args.findIndex((arg) => !arg.startsWith("-"));
+    const sub = invocation.args[at] ?? "";
+    const rest = invocation.args.slice(at + 1);
+    if (!MUTATING_GIT.has(sub) || inert(rest, sub))
+      return [];
+    if (sub === "stash" && ["list", "show"].includes(rest[0] ?? ""))
+      return [];
+    return [path23.resolve(cwd, invocation.dir ?? ".")];
+  });
+}, CD2, PUSHD2, POPD2, cdInto = (dir, words) => {
+  const target = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
+  if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
+    return;
+  return target === undefined ? os7.homedir() : path23.resolve(dir, target);
+}, quoteWord = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`, segmentTargets = (cwd, command, dialect) => {
+  const targets = [];
+  let dir = cwd;
+  let stack = [];
+  const groups = [];
+  const at = (file) => path23.isAbsolute(file) ? file : dir === undefined ? null : path23.resolve(dir, file);
+  for (const segment of segmentsOf(command, dialect)) {
+    if (segment.group === "open") {
+      groups.push({ dir, stack: [...stack] });
+      continue;
+    }
+    if (segment.group === "close") {
+      const saved = groups.pop();
+      if (saved)
+        ({ dir, stack } = saved);
+      continue;
+    }
+    const lead = segment.words.findIndex((word) => !/^\w+=/.test(word));
+    const words = lead < 0 ? [] : segment.words.slice(lead);
+    const name = (words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+    if (CD2.has(name)) {
+      dir = cdInto(dir, words);
+      continue;
+    }
+    if (PUSHD2.has(name)) {
+      stack.push(dir);
+      dir = cdInto(dir, words);
+      continue;
+    }
+    if (POPD2.has(name)) {
+      dir = stack.length ? stack.pop() : undefined;
+      continue;
+    }
+    for (const file of segment.redirects)
+      if (!/^\/dev\/(?:null|stdout|stderr|tty)$/.test(file)) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(resolved);
+      }
+    const edits = editsOf(segment.words);
+    if (edits === null) {
+      if (dir !== undefined)
+        targets.push(path23.join(dir, DIR_TARGET));
+    } else
+      for (const file of edits) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(resolved);
+      }
+    if (dir !== undefined && workitInvocations(segment.words.map(quoteWord).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
+      targets.push(path23.join(dir, DIR_TARGET));
+  }
+  return targets;
+}, overridden = (command, dialect) => {
+  const segments = segmentsOf(command, dialect);
+  if (segments.length !== 1 || segments[0].group || segments[0].subs?.length)
+    return false;
+  const words = segments[0].words;
+  const lead = words.findIndex((word) => !/^\w+=/.test(word));
+  return lead > 0 && words.slice(0, lead).includes(OVERRIDE);
+}, HOST_LABELS, ageText = (ms) => {
+  const seconds = Math.max(0, Math.round(ms / 1000));
+  return seconds < 120 ? `${seconds}s` : `${Math.round(seconds / 60)} min`;
+}, liveDeny = ({ marker, checkout, ageMs, file }) => {
+  const unblock = `Work in your own worktree (\`git worktree add <path> -b <branch>\`, or \`workit fanout worktree create <slice>\`). Only if the user confirms that session is finished: release it with \`rm '${file}'\`, or prefix one command with ${OVERRIDE}.`;
+  return {
+    kind: "deny",
+    reason: `workit live-session guard: ${checkout} belongs to another live agent session, ${HOST_LABELS[marker.host] ?? marker.host} session ${marker.session}${marker.pid === null ? "" : ` (pid ${marker.pid})`}, last active ${ageText(ageMs)} ago. Do not edit a checkout another session is working in; read-only commands stay allowed. ${unblock}`,
+    unblock
+  };
+}, guarded = (targets) => {
+  const seen = new Set;
+  return targets.filter((target) => {
+    const dir = path23.dirname(target);
+    if (seen.has(dir))
+      return false;
+    seen.add(dir);
+    return true;
+  });
+}, liveGate = (owner, targets, deps) => {
+  try {
+    for (const target of guarded(targets)) {
+      const conflict = liveConflict(target, owner, deps);
+      if (conflict && workspaceLiveSessionGuard(conflict.checkout))
+        return liveDeny(conflict);
+    }
+  } catch {}
+  return NONE3;
+}, claimAll = (owner, targets, deps) => {
+  for (const target of guarded(targets))
+    claimLiveSession(target, owner, deps);
+}, liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path23.resolve(cwd, file)) : [path23.join(cwd, DIR_TARGET)], noteOverride = (cwd, owner, command) => {
+  try {
+    if (!inWorkitWorkspace(cwd))
+      return;
+    appendHookObserved(cwd, {
+      type: "live_session.override",
+      actor: { host: owner.host, session: owner.session, agentId: null },
+      session: owner.session,
+      command: command.slice(0, 200)
+    });
+  } catch {}
 };
 var init_write_gate = __esm(() => {
   init_task_store();
   init_derive();
   init_task_evaluation();
+  init_live_session();
+  init_workspaces();
   init_ledger();
+  init_raw_git();
   init_shell_words();
   NONE3 = { kind: "none" };
   CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
   PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
   cache2 = new Map;
+  MUTATING_GIT = new Set([
+    "add",
+    "am",
+    "apply",
+    "checkout",
+    "cherry-pick",
+    "clean",
+    "commit",
+    "merge",
+    "mv",
+    "pull",
+    "rebase",
+    "reset",
+    "restore",
+    "revert",
+    "rm",
+    "stash",
+    "switch"
+  ]);
+  DRY_N = new Set(["add", "clean", "rm", "mv"]);
+  MUTATING_WORKIT_GIT = new Set(["commit", "branch"]);
+  CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
+  PUSHD2 = new Set(["pushd", "push-location"]);
+  POPD2 = new Set(["popd", "pop-location"]);
+  HOST_LABELS = {
+    claude_code: "Claude Code",
+    opencode: "OpenCode",
+    codex_cli: "Codex CLI",
+    codex_desktop: "Codex Desktop",
+    cursor: "Cursor",
+    pi: "Pi"
+  };
 });
 
 // packages/workit-core/src/hooks/stop.ts
-import { spawnSync as spawnSync13 } from "node:child_process";
+import { spawnSync as spawnSync14 } from "node:child_process";
 function stopObligation(input, descriptor) {
   try {
     const session = input.session.id;
@@ -20294,7 +20736,7 @@ var NONE4, QUESTION, OFFER, YES_NO, LIST_ITEM, asksUser = (message) => {
 `);
   return QUESTION.test(tail) || OFFER.test(tail) || YES_NO.test(tail);
 }, short = (sha) => (sha ?? "?").slice(0, 12), gitList = (cwd, args) => {
-  const run = spawnSync13("git", args, {
+  const run = spawnSync14("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 3000,
@@ -20606,9 +21048,9 @@ var init_skill_nudge = __esm(() => {
 
 // packages/workit-core/src/hooks/hosts/fields.ts
 import { existsSync as existsSync7, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 var isRecord4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value), nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "", optionalText = (value) => typeof value === "string" ? value : null, existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path23.isAbsolute(value) || !existsSync7(value))
+  if (!nonEmpty2(value) || !path24.isAbsolute(value) || !existsSync7(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -20713,8 +21155,7 @@ function handleHook(input, deps) {
       const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE5;
       if (raw.kind === "deny")
         return raw;
-      const writes = usable2(descriptor.events["write.pre"].support) ? shellWrites(event.command) : { writes: false, targets: null };
-      const gate = writes.writes ? writeGate(input.cwd, writes.targets) : NONE5;
+      const gate = usable2(descriptor.events["write.pre"].support) ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect) : NONE5;
       if (gate.kind === "deny")
         return gate;
       noteRawCommit(input, event.command, postTool ? callKey(event.toolUseId, event.command) : NEXT_COMMAND);
@@ -20727,7 +21168,7 @@ function handleHook(input, deps) {
         rawGitPost(input, event.command, callKey(event.toolUseId, event.command));
       return NONE5;
     case "write.pre":
-      return usable2(descriptor.events["write.pre"].support) ? writeGate(input.cwd, event.paths) : NONE5;
+      return usable2(descriptor.events["write.pre"].support) ? writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport)) : NONE5;
     case "subagent.start":
       return {
         kind: "context",
@@ -20810,6 +21251,7 @@ var init_handle = __esm(() => {
   init_raw_git();
   init_skill_nudge();
   init_stop();
+  init_live_session();
   init_write_gate();
   NONE5 = { kind: "none" };
   offered = new Set;
@@ -21348,8 +21790,8 @@ var init_codex = __esm(() => {
 });
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import fs17 from "node:fs";
-import path24 from "node:path";
+import fs18 from "node:fs";
+import path25 from "node:path";
 var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (value) => {
   if (!isRecord4(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
@@ -21430,17 +21872,17 @@ var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (valu
       };
   }
 }, TRANSCRIPT_TAIL_BYTES, lastAssistantText = (file) => {
-  if (!file || !path24.isAbsolute(file))
+  if (!file || !path25.isAbsolute(file))
     return null;
   try {
-    const size = fs17.statSync(file).size;
+    const size = fs18.statSync(file).size;
     const start = Math.max(0, size - TRANSCRIPT_TAIL_BYTES);
     const buffer = Buffer.alloc(size - start);
-    const fd = fs17.openSync(file, "r");
+    const fd = fs18.openSync(file, "r");
     try {
-      fs17.readSync(fd, buffer, 0, buffer.length, start);
+      fs18.readSync(fd, buffer, 0, buffer.length, start);
     } finally {
-      fs17.closeSync(fd);
+      fs18.closeSync(fd);
     }
     const lines = buffer.toString("utf8").split(`
 `);
@@ -21466,7 +21908,7 @@ var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (valu
   } catch {
     return null;
   }
-}, within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path24.sep) ? root : `${root}${path24.sep}`), hookCwd = (input) => {
+}, within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path25.sep) ? root : `${root}${path25.sep}`), hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
     return cwd;
@@ -21692,6 +22134,7 @@ var init_hooks = __esm(async () => {
   init_context();
   init_policy();
   init_write_gate();
+  init_live_session();
   init_stop();
   init_raw_git();
   init_skill_nudge();