@brainervirus/workit-cursor 8.16.0 → 8.17.0

package/dist/workit-hook.js

@@ -9366,6 +9366,7 @@ var workspaceConfigSchema = object({
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
   defaultEndpoint: unknown().optional(),
   verification: _enum(["self", "independent"]).optional(),
+  delegation: unknown().optional(),
   trailers: boolean2().optional(),
   liveSessionGuard: boolean2().optional(),
   fanout: object({ tierModels: unknown().optional() }).passthrough().optional(),
@@ -15071,6 +15072,17 @@ import fs12 from "node:fs";
 import path16 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
 var CHECKS_FILE = "workit.checks.json";
+var checksConfigFile = (root) => path16.join(root, CHECKS_FILE);
+function repoHeavyCommands(root) {
+  try {
+    const value = JSON.parse(fs12.readFileSync(checksConfigFile(root), "utf8"));
+    const resources = isRecord3(value) ? value.resources : undefined;
+    const list = isRecord3(resources) ? resources.heavyCommands : undefined;
+    return Array.isArray(list) ? list.filter((item) => typeof item === "string") : [];
+  } catch {
+    return [];
+  }
+}
 var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var SHELL_META = /[|&;<>()$`\\*?[\]{}~!#]/u;
 function splitCommand(command) {
@@ -15183,7 +15195,7 @@ function detectedChecks(root) {
 var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
-  const file = path16.join(root, CHECKS_FILE);
+  const file = checksConfigFile(root);
   const none = (error = null) => ({
     source: error ? CHECKS_FILE : "none",
     root,
@@ -19232,7 +19244,16 @@ function rawInvocations(command, dialect = "posix", depth = 0) {
   return found;
 }
 var RECENT = new Map;
-function walk2(command, dialect, depth) {
+function commandLines(command, dialect = "posix") {
+  const lines = [];
+  try {
+    walk2(command, dialect, 0, lines);
+  } catch (error) {
+    throw error instanceof ShellAnalysisError ? error : new ShellAnalysisError(error instanceof Error ? error.message : String(error));
+  }
+  return lines;
+}
+function walk2(command, dialect, depth, seen) {
   const found = [];
   let dir = null;
   const groups = [];
@@ -19243,7 +19264,8 @@ function walk2(command, dialect, depth) {
   const nested = (script, inner) => {
     if (!script || depth >= MAX_DEPTH)
       return;
-    for (const invocation of rawInvocations(script, inner, depth + 1))
+    const inside = seen ? walk2(script, inner, depth + 1, seen) : rawInvocations(script, inner, depth + 1);
+    for (const invocation of inside)
       found.push({ ...invocation, dir: rebase(dir, invocation.dir) });
   };
   const visit = (input, stdin, hops) => {
@@ -19255,11 +19277,17 @@ function walk2(command, dialect, depth) {
     const name = commandName(words[0]);
     if (!name)
       return;
+    seen?.push(words);
+    if (name === "-c" || name === "--command")
+      return nested(words[1], "posix");
     const runs = (lines) => {
       if (hops < MAX_DEPTH)
         for (const next of lines)
           visit(next, undefined, hops + 1);
     };
+    const wrapped = seen ? null : workitCheckTail(words);
+    if (wrapped)
+      return "script" in wrapped ? nested(wrapped.script, "posix") : runs([wrapped.argv]);
     if (CD.has(name)) {
       const target = cdTarget(words);
       dir = target === null ? os5.homedir() : joinDir(dir, target);
@@ -19350,6 +19378,51 @@ var LAUNCHERS = new Set([
   "command"
 ]);
 var WORKIT_BIN = /(?:^|[\\/])workit(?:\.exe)?$|^@brainervirus\/workit-cli$/;
+var WORKIT_PACKAGE = /^@brainervirus\/workit-cli(?:@\S*)?$/;
+var PACKAGE_RUNNERS = new Set(["npx", "bunx", "pnpx"]);
+function workitCheckTail(words) {
+  let at = 0;
+  if (PACKAGE_RUNNERS.has(commandName(words[0]))) {
+    at = words.findIndex((word, index) => index > 0 && !word.startsWith("-"));
+    if (at < 0 || !WORKIT_PACKAGE.test(words[at]))
+      return null;
+  } else if (!/^workit(?:\.exe|\.cmd)?$/.test(commandName(words[0])))
+    return null;
+  const args = words.slice(at + 1);
+  if (args[0] !== "check" && !(args[0] === "lock" && args[1] === "run"))
+    return null;
+  const split = args.indexOf("--");
+  const tail = split < 0 ? [] : args.slice(split + 1);
+  if (!tail.length)
+    return null;
+  return args.slice(0, split).includes("--shell") ? { script: tail.join(" ") } : { argv: tail };
+}
+function simpleCommand(command, dialect = "posix", depth = 0) {
+  let segments;
+  try {
+    segments = segmentsOf(command, dialect);
+  } catch {
+    return null;
+  }
+  if (segments.length !== 1)
+    return null;
+  const [segment] = segments;
+  if (segment.group || segment.pipe || segment.unanalyzable || segment.redirects.length || segment.subs?.length || segment.stdin?.length)
+    return null;
+  const { words } = stripPrefixes(segment.words);
+  const name = commandName(words[0]);
+  if (!name || depth >= MAX_DEPTH)
+    return null;
+  if (SHELLS.has(name)) {
+    const script = shellScript(words, undefined);
+    return script ? simpleCommand(script, "posix", depth + 1) : null;
+  }
+  if (name === "-c" || name === "--command")
+    return words[1] ? simpleCommand(words[1], "posix", depth + 1) : null;
+  if (EVALS.has(name) || POWERSHELLS.has(name) || ["xargs", "find", "parallel", "script", "cmd", "source", "."].includes(name))
+    return null;
+  return words;
+}
 function workitInvocations(command, dialect = "posix", depth = 0) {
   const found = [];
   for (const { words } of segmentsOf(command, dialect)) {
@@ -20377,17 +20450,827 @@ var shellPolicy = (cwd, command, dialect = "posix") => {
   }
   return policy && !policy.ok ? { kind: "deny", reason: `branch_policy_denied: ${policy.error}`, unblock: null } : { kind: "none" };
 };
-// packages/workit-core/src/hooks/write-gate.ts
-import { realpathSync as realpathSync5 } from "node:fs";
+// packages/workit-core/src/core/heavy-rules.ts
+import fs17 from "node:fs";
+import os6 from "node:os";
+import path22 from "node:path";
+var EMPTY = () => ({ deny: [], allow: [] });
+var readText2 = (file) => {
+  try {
+    return fs17.readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+};
+var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function parseJsonc(text) {
+  let out = "";
+  for (let index = 0;index < text.length; index += 1) {
+    const char = text[index];
+    if (char === '"') {
+      const end = /"(?:[^"\\]|\\.)*"/y;
+      end.lastIndex = index;
+      const match = end.exec(text);
+      if (!match)
+        throw new Error("unterminated string");
+      out += match[0];
+      index += match[0].length - 1;
+    } else if (char === "/" && text[index + 1] === "/") {
+      while (index < text.length && text[index] !== `
+`)
+        index += 1;
+      out += `
+`;
+    } else if (char === "/" && text[index + 1] === "*") {
+      const close = text.indexOf("*/", index + 2);
+      if (close < 0)
+        throw new Error("unterminated comment");
+      index = close + 1;
+    } else
+      out += char;
+  }
+  return JSON.parse(out.replace(/,(\s*[}\]])/gu, "$1"));
+}
+function gitTop(cwd) {
+  for (let dir = path22.resolve(cwd);; dir = path22.dirname(dir)) {
+    if (fs17.existsSync(path22.join(dir, ".git")))
+      return dir;
+    if (path22.dirname(dir) === dir)
+      return null;
+  }
+}
+var projectDirs = (cwd) => {
+  const top = gitTop(cwd);
+  const dirs = [];
+  for (let dir = path22.resolve(cwd);; dir = path22.dirname(dir)) {
+    dirs.push(dir);
+    if (!top || dir === top || path22.dirname(dir) === dir)
+      return dirs;
+  }
+};
+var homeOf = (env) => env.HOME || os6.homedir();
+var CLAUDE_MANAGED = {
+  linux: "/etc/claude-code/managed-settings.json",
+  darwin: "/Library/Application Support/ClaudeCode/managed-settings.json",
+  win32: "C:\\Program Files\\ClaudeCode\\managed-settings.json"
+};
+function claudeSettingsFiles(cwd, env, platform = process.platform) {
+  const project = env.CLAUDE_PROJECT_DIR || gitTop(cwd) || cwd;
+  const user = env.CLAUDE_CONFIG_DIR || path22.join(homeOf(env), ".claude");
+  return [
+    ...CLAUDE_MANAGED[platform] ? [CLAUDE_MANAGED[platform]] : [],
+    path22.join(user, "settings.json"),
+    path22.join(project, ".claude", "settings.json"),
+    path22.join(project, ".claude", "settings.local.json")
+  ];
+}
+var bashPattern = (entry) => {
+  const match = /^Bash(?:\((.*)\))?$/su.exec(entry.trim());
+  return match ? match[1] ?? "" : null;
+};
+function claudeRules(cwd, env = process.env) {
+  const rules = EMPTY();
+  try {
+    for (const file of claudeSettingsFiles(cwd, env)) {
+      const text = readText2(file);
+      if (text === null)
+        continue;
+      const value = JSON.parse(text);
+      if (!isRecord4(value))
+        return "unreadable";
+      const permissions = value.permissions;
+      if (permissions === undefined)
+        continue;
+      if (!isRecord4(permissions))
+        return "unreadable";
+      for (const [key, bucket] of [
+        ["deny", rules.deny],
+        ["ask", rules.deny],
+        ["allow", rules.allow]
+      ]) {
+        const list = permissions[key];
+        if (list === undefined)
+          continue;
+        if (!Array.isArray(list))
+          return "unreadable";
+        for (const entry of list) {
+          if (typeof entry !== "string")
+            return "unreadable";
+          const pattern = bashPattern(entry);
+          if (pattern !== null)
+            bucket.push(pattern);
+        }
+      }
+    }
+  } catch {
+    return "unreadable";
+  }
+  return rules;
+}
+var OPENCODE_NAMES = ["opencode.json", "opencode.jsonc"];
+var opencodePermission = (permission, rules) => {
+  if (permission === undefined)
+    return true;
+  if (typeof permission === "string") {
+    (permission === "allow" ? rules.allow : rules.deny).push("");
+    return ["allow", "ask", "deny"].includes(permission);
+  }
+  if (!isRecord4(permission))
+    return false;
+  for (const key of ["bash", "shell"]) {
+    const value = permission[key];
+    if (value === undefined)
+      continue;
+    if (typeof value === "string") {
+      if (!["allow", "ask", "deny"].includes(value))
+        return false;
+      (value === "allow" ? rules.allow : rules.deny).push("");
+      continue;
+    }
+    if (!isRecord4(value))
+      return false;
+    for (const [pattern, action] of Object.entries(value)) {
+      if (action !== "allow" && action !== "ask" && action !== "deny")
+        return false;
+      (action === "allow" ? rules.allow : rules.deny).push(pattern);
+    }
+  }
+  return true;
+};
+var opencodeConfig = (value, rules) => {
+  if (!isRecord4(value))
+    return false;
+  if (!opencodePermission(value.permission, rules))
+    return false;
+  if (value.agent === undefined)
+    return true;
+  if (!isRecord4(value.agent))
+    return false;
+  return Object.values(value.agent).every((agent) => isRecord4(agent) && opencodePermission(agent.permission, rules));
+};
+function opencodeRules(cwd, env = process.env) {
+  const rules = EMPTY();
+  try {
+    const config = env.XDG_CONFIG_HOME || path22.join(homeOf(env), ".config");
+    const files = [
+      ...OPENCODE_NAMES.map((name) => path22.join(config, "opencode", name)),
+      ...projectDirs(cwd).flatMap((dir) => OPENCODE_NAMES.flatMap((name) => [path22.join(dir, name), path22.join(dir, ".opencode", name)])),
+      ...env.OPENCODE_CONFIG ? [env.OPENCODE_CONFIG] : []
+    ];
+    for (const file of files) {
+      const text = readText2(file);
+      if (text !== null && !opencodeConfig(parseJsonc(text), rules))
+        return "unreadable";
+    }
+    if (env.OPENCODE_CONFIG_CONTENT && !opencodeConfig(parseJsonc(env.OPENCODE_CONFIG_CONTENT), rules))
+      return "unreadable";
+  } catch {
+    return "unreadable";
+  }
+  return rules;
+}
+var codexRule = (body) => {
+  const open = /\bpattern\s*=\s*\[/u.exec(body);
+  if (!open)
+    return null;
+  const words = [];
+  let index = open.index + open[0].length;
+  for (;; ) {
+    while (/[\s,]/u.test(body[index] ?? ""))
+      index += 1;
+    if (body[index] === "]")
+      break;
+    if (body[index] !== '"')
+      return null;
+    const literal = /"((?:[^"\\]|\\.)*)"/y;
+    literal.lastIndex = index;
+    const match = literal.exec(body);
+    if (!match)
+      return null;
+    words.push(JSON.parse(`"${match[1]}"`));
+    index = literal.lastIndex;
+  }
+  const decision = /\bdecision\s*=\s*"(\w+)"/u.exec(body)?.[1];
+  if (!words.length || !decision || !["allow", "prompt", "forbidden"].includes(decision))
+    return null;
+  return { pattern: words.join(" "), decision };
+};
+function codexRules(cwd, env = process.env) {
+  const rules = EMPTY();
+  try {
+    const home = env.CODEX_HOME || path22.join(homeOf(env), ".codex");
+    const top = gitTop(cwd) ?? cwd;
+    for (const dir of [path22.join(home, "rules"), path22.join(top, ".codex", "rules")]) {
+      let files;
+      try {
+        files = fs17.readdirSync(dir).filter((name) => name.endsWith(".rules"));
+      } catch (error) {
+        if (error.code === "ENOENT")
+          continue;
+        return "unreadable";
+      }
+      for (const name of files) {
+        const text = readText2(path22.join(dir, name)) ?? "";
+        for (const part of text.split(/\bprefix_rule\s*\(/u).slice(1)) {
+          const rule = codexRule(part);
+          if (!rule)
+            return "unreadable";
+          (rule.decision === "allow" ? rules.allow : rules.deny).push(rule.pattern);
+        }
+      }
+    }
+  } catch {
+    return "unreadable";
+  }
+  return rules;
+}
+function cursorRules(cwd, env = process.env) {
+  const rules = EMPTY();
+  try {
+    const top = gitTop(cwd) ?? cwd;
+    for (const file of [
+      path22.join(homeOf(env), ".cursor", "cli-config.json"),
+      path22.join(top, ".cursor", "cli.json")
+    ]) {
+      const text = readText2(file);
+      if (text === null)
+        continue;
+      const value = JSON.parse(text);
+      if (!isRecord4(value))
+        return "unreadable";
+      if (value.permissions === undefined)
+        continue;
+      if (!isRecord4(value.permissions))
+        return "unreadable";
+      for (const [key, bucket] of [
+        ["deny", rules.deny],
+        ["allow", rules.allow]
+      ]) {
+        const list = value.permissions[key];
+        if (list === undefined)
+          continue;
+        if (!Array.isArray(list))
+          return "unreadable";
+        for (const entry of list) {
+          if (typeof entry !== "string")
+            return "unreadable";
+          const match = /^Shell(?:\((.*)\))?$/su.exec(entry.trim());
+          if (match)
+            bucket.push(match[1] ?? "");
+        }
+      }
+    }
+  } catch {
+    return "unreadable";
+  }
+  return rules;
+}
+var baseName = (word) => (word.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat)$/u, "");
+var firstToken = (pattern) => pattern.trim().split(/[:\s]/u)[0] ?? "";
+function names(pattern, words) {
+  const token = firstToken(pattern);
+  if (!token || token === "*" || token.includes("*"))
+    return true;
+  const wanted = baseName(token);
+  return words.some((word) => baseName(word) === wanted);
+}
+var literalPrefix = (pattern) => pattern.trim().replace(/(?::\*| \*|\*)$/u, "");
+var coversWrapper = (pattern) => {
+  const token = firstToken(pattern);
+  if (!token || token.includes("*"))
+    return true;
+  const words = literalPrefix(pattern).split(/\s+/u);
+  if (baseName(words[0]) !== "workit")
+    return false;
+  return ["check", "--heavy"].slice(0, words.length - 1).every((word, at) => {
+    const given = words[at + 1];
+    return given === word || word.startsWith(given);
+  });
+};
+var coversCommand = (pattern, command) => {
+  const prefix = literalPrefix(pattern);
+  if (!prefix)
+    return true;
+  return !prefix.includes("*") && command.trim().startsWith(prefix);
+};
+function wrapAllowed(read, words, command, options = {}) {
+  if (read === "unreadable")
+    return { ok: false, why: "named" };
+  if (read.deny.some((pattern) => names(pattern, words)))
+    return { ok: false, why: "named" };
+  if (!options.bypass && read.allow.some(coversWrapper) && !read.allow.some((pattern) => coversCommand(pattern, command)))
+    return { ok: false, why: "allowlisted" };
+  return { ok: true };
+}
+
+// packages/workit-core/src/core/heavy.ts
+import fs18 from "node:fs";
 import os7 from "node:os";
 import path23 from "node:path";
+function stateDir(env, platform = process.platform) {
+  if (env.WORKFLOW_TOOLKIT_STATE)
+    return env.WORKFLOW_TOOLKIT_STATE;
+  if (env.XDG_STATE_HOME)
+    return path23.join(env.XDG_STATE_HOME, "workit");
+  const home = env.HOME || os7.homedir();
+  if (platform === "darwin")
+    return path23.join(home, "Library", "Application Support", "workit");
+  if (platform === "win32")
+    return path23.join(env.LOCALAPPDATA ?? path23.join(home, "AppData", "Local"), "workit");
+  return path23.join(home, ".local", "state", "workit");
+}
+var HEAVY_COMMANDS_FILE = "heavy-commands.json";
+var heavyCommandsFile = (env) => path23.join(stateDir(env), HEAVY_COMMANDS_FILE);
+var HEAVY_SCRIPT = /^(?:test|tests|t|tst|unit|integration|e2e|coverage|cov|lint|eslint|typecheck|type-check|types|tsc|check|verify|validate|build|compile|bundle|ci|sonar|cypress|playwright|jest|vitest|mocha|bench|benchmark|all)(?:$|[:_.-])/iu;
+var INFO_FLAGS = new Set(["--version", "-v", "-V", "--help", "-h", "help", "version"]);
+var WATCH_FLAG = /^(?:--watch(?:All)?(?:=.*)?|-w|--serve)$/u;
+var WATCH_SCRIPT = /(?:^|[:_.-])(?:watch|dev|serve|start|storybook)(?:$|[:_.-])/iu;
+var sub = (...names) => new Set(names);
+var TOOLS = {
+  jest: "any",
+  vitest: "any",
+  mocha: "any",
+  ava: "any",
+  tap: "any",
+  karma: "any",
+  jasmine: "any",
+  nyc: "any",
+  c8: "any",
+  tsc: "any",
+  "vue-tsc": "any",
+  "svelte-check": "any",
+  eslint: "any",
+  stylelint: "any",
+  tslint: "any",
+  webpack: "any",
+  "webpack-cli": "any",
+  rollup: "any",
+  parcel: "any",
+  tsup: "any",
+  vite: sub("build", "optimize"),
+  next: sub("build", "lint"),
+  nuxt: sub("build", "generate"),
+  nuxi: sub("build", "generate"),
+  astro: sub("build", "check"),
+  ng: sub("build", "b", "test", "t", "e2e", "lint"),
+  "react-scripts": sub("build", "test"),
+  playwright: sub("test", "install"),
+  cypress: sub("run"),
+  wdio: "any",
+  testcafe: "any",
+  turbo: "any",
+  lerna: sub("run", "exec", "bootstrap"),
+  "sonar-scanner": "any",
+  sonarless: sub("scan"),
+  "sonarless-mcp": sub("scan"),
+  go: sub("test", "build", "vet", "install", "generate"),
+  "golangci-lint": sub("run"),
+  gotestsum: "any",
+  staticcheck: "any",
+  cargo: sub("build", "b", "test", "t", "check", "c", "clippy", "bench", "nextest", "doc", "install", "tarpaulin", "llvm-cov"),
+  mvn: "any",
+  mvnw: "any",
+  gradle: "any",
+  gradlew: "any",
+  ant: "any",
+  sbt: "any",
+  bazel: sub("build", "test", "run", "coverage"),
+  bazelisk: sub("build", "test", "run", "coverage"),
+  buck2: sub("build", "test", "run"),
+  dotnet: sub("build", "test", "publish", "restore", "pack", "msbuild"),
+  msbuild: "any",
+  pytest: "any",
+  "py.test": "any",
+  tox: "any",
+  nox: "any",
+  mypy: "any",
+  pyright: "any",
+  pylint: "any",
+  coverage: sub("run"),
+  maturin: sub("build", "develop"),
+  pip: sub("install", "wheel"),
+  pip3: sub("install", "wheel"),
+  rspec: "any",
+  rails: sub("test", "assets:precompile"),
+  phpunit: "any",
+  pest: "any",
+  phpstan: "any",
+  psalm: "any",
+  composer: sub("install", "update", "require", "test"),
+  mix: sub("test", "compile", "deps.get", "dialyzer", "credo"),
+  swift: sub("build", "test"),
+  xcodebuild: "any",
+  flutter: sub("build", "test"),
+  dart: sub("test", "compile"),
+  pod: sub("install"),
+  cmake: sub("--build"),
+  ninja: "any",
+  meson: sub("compile", "test"),
+  ctest: "any",
+  scons: "any",
+  "docker-compose": sub("build"),
+  buildah: sub("bud", "build"),
+  earthly: "any"
+};
+var PM_VALUES = new Set([
+  "--prefix",
+  "-w",
+  "--workspace",
+  "-C",
+  "--dir",
+  "--filter",
+  "-F",
+  "--cwd",
+  "-p",
+  "--package",
+  "--cache",
+  "--registry"
+]);
+function positional2(words, from, values = PM_VALUES) {
+  let index = from;
+  while (index < words.length && words[index].startsWith("-")) {
+    if (words[index] === "--")
+      return index + 1;
+    index += values.has(words[index]) ? 2 : 1;
+  }
+  return index;
+}
+var baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, "");
+var WORKIT = /^(?:workit|@brainervirus\/workit-cli(?:@.*)?)$/u;
+var PYTHONS = /^(?:python[\d.]*|py)$/u;
+var NPM_INSTALL = new Set([
+  "ci",
+  "clean-install",
+  "cit",
+  "install-test",
+  "it",
+  "install",
+  "i",
+  "in",
+  "add",
+  "rebuild",
+  "update",
+  "up"
+]);
+var NPM_RUN = new Set(["run", "run-script", "rum", "urn"]);
+var NPM_TEST = new Set(["test", "t", "tst"]);
+var EXEC = new Set(["exec", "x", "dlx"]);
+function builtIn(words, depth = 0) {
+  if (depth > 6 || !words.length)
+    return null;
+  const name = baseName2(words[0]);
+  const label = () => words.slice(0, 3).join(" ");
+  const inner = (from) => builtIn(words.slice(from), depth + 1);
+  if (WORKIT.test(name))
+    return null;
+  if (INFO_FLAGS.has(words[1] ?? "") && words.length === 2)
+    return null;
+  if (words.some((word) => word === "--watch" || word.startsWith("--watch=") || word === "--watchAll"))
+    return null;
+  if (name === "npx" || name === "bunx" || name === "pnpx")
+    return inner(positional2(words, 1));
+  if (name === "corepack")
+    return inner(1);
+  if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun" || name === "deno") {
+    const at = positional2(words, 1);
+    const command = words[at];
+    if (command === undefined)
+      return name === "yarn" ? "yarn (install)" : null;
+    if (name === "deno") {
+      if (["test", "bench", "check", "compile", "lint"].includes(command))
+        return label();
+      if (command === "task" && HEAVY_SCRIPT.test(words[at + 1] ?? ""))
+        return label();
+      return null;
+    }
+    if (NPM_INSTALL.has(command) || NPM_TEST.has(command))
+      return label();
+    if (name === "bun" && command === "build")
+      return label();
+    if (EXEC.has(command))
+      return inner(positional2(words, at + 1));
+    if (name === "yarn" && command === "workspace")
+      return inner(at + 2);
+    if (name === "yarn" && command === "workspaces")
+      return words.slice(at + 1).some((word) => HEAVY_SCRIPT.test(word)) ? label() : null;
+    if (NPM_RUN.has(command)) {
+      const script = words[positional2(words, at + 1)];
+      if (script === undefined || WATCH_SCRIPT.test(script))
+        return null;
+      if (HEAVY_SCRIPT.test(script))
+        return label();
+      return name === "bun" ? inner(positional2(words, at + 1)) : null;
+    }
+    if (name === "npm")
+      return null;
+    if (WATCH_SCRIPT.test(command))
+      return null;
+    if (HEAVY_SCRIPT.test(command) && !/\.[cm]?[jt]sx?$/u.test(command))
+      return label();
+    return inner(at);
+  }
+  if (PYTHONS.test(name)) {
+    const at = words.indexOf("-m");
+    return at > 0 && words[at + 1] ? inner(at + 1) : null;
+  }
+  if (["uv", "poetry", "pdm", "pipenv", "hatch", "rye"].includes(name)) {
+    const at = positional2(words, 1);
+    const command = words[at];
+    if (command === "run")
+      return inner(positional2(words, at + 1));
+    if (command === "pip")
+      return inner(at);
+    return ["sync", "install", "build", "test", "add"].includes(command ?? "") ? label() : null;
+  }
+  if (name === "bundle") {
+    const command = words[positional2(words, 1)];
+    if (command === "exec")
+      return inner(positional2(words, 2));
+    return command === "install" || command === undefined ? label() : null;
+  }
+  if (name === "make" || name === "gmake") {
+    const targets = words.slice(1).filter((word) => !word.startsWith("-") && !word.includes("="));
+    if (targets.some((target) => WATCH_SCRIPT.test(target)))
+      return null;
+    return !targets.length || targets.some((target) => HEAVY_SCRIPT.test(target)) ? label() : null;
+  }
+  if (name === "rake") {
+    const targets = words.slice(1).filter((word) => !word.startsWith("-") && !word.includes("="));
+    return targets.some((target) => HEAVY_SCRIPT.test(target) || /^spec(?:$|:)/u.test(target)) ? label() : null;
+  }
+  if (name === "nx") {
+    const at = positional2(words, 1);
+    const command = words[at] ?? "";
+    if (["run-many", "affected"].includes(command))
+      return words.some((word) => /^(?:-t|--targets?)(?:=|$)/u.test(word)) && !words.some((word) => WATCH_SCRIPT.test(word.replace(/^--?targets?=/u, ""))) ? label() : null;
+    if (command === "run") {
+      const target = (words[at + 1] ?? "").split(":")[1] ?? "";
+      return HEAVY_SCRIPT.test(target) && !WATCH_SCRIPT.test(target) ? label() : null;
+    }
+    return HEAVY_SCRIPT.test(command) && !WATCH_SCRIPT.test(command) ? label() : null;
+  }
+  if (name === "docker" || name === "podman" || name === "nerdctl") {
+    const at = positional2(words, 1, new Set(["-H", "--host", "--context", "-c", "--config"]));
+    const command = words[at];
+    if (command === "build")
+      return label();
+    if (command === "buildx" || command === "image" || command === "builder")
+      return words[positional2(words, at + 1)] === "build" ? label() : null;
+    if (command === "compose") {
+      const at2 = positional2(words, at + 1, new Set(["-f", "--file", "-p"]));
+      const action = words[at2];
+      if (action === "build")
+        return label();
+      return action === "up" && words.slice(at2 + 1).includes("--build") ? label() : null;
+    }
+    return null;
+  }
+  const rule = TOOLS[name];
+  if (!rule)
+    return null;
+  if (words.slice(1).some((word) => WATCH_FLAG.test(word) || word === "watch" || word === "dev"))
+    return null;
+  if (rule === "any")
+    return label();
+  const command = words.slice(1).find((word) => !word.startsWith("-") && !word.startsWith("+") || rule.has(word));
+  return command !== undefined && rule.has(command) ? label() : null;
+}
+var globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u");
+function parsePattern(pattern) {
+  const words = pattern.trim().split(/\s+/u).filter(Boolean);
+  return words.length ? words.map(globWord) : null;
+}
+var matches = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index]));
+var readJson = (file) => {
+  try {
+    return JSON.parse(fs18.readFileSync(file, "utf8"));
+  } catch {
+    return;
+  }
+};
+var isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var stringList = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+function machinePatterns(env) {
+  const value = readJson(heavyCommandsFile(env));
+  return isRecord5(value) ? stringList(value.patterns) : [];
+}
+function repoPatterns(cwd) {
+  return repoHeavyCommands(gitTop(cwd) ?? path23.resolve(cwd));
+}
+function heavyLines(lines, options) {
+  const found = [];
+  let patterns = null;
+  for (const line of lines) {
+    const reason = builtIn(line);
+    if (reason) {
+      found.push({ line, source: "catalog", reason });
+      continue;
+    }
+    patterns ??= (options.patterns ?? [
+      ...machinePatterns(options.env ?? process.env).map((pattern) => ({
+        pattern,
+        from: "machine"
+      })),
+      ...repoPatterns(options.cwd).map((pattern) => ({ pattern, from: "repo" }))
+    ]).flatMap((entry) => {
+      const matchers = parsePattern(entry.pattern);
+      return matchers ? [{ ...entry, matchers }] : [];
+    });
+    const hit = patterns.find((entry) => matches(entry.matchers, line));
+    if (hit)
+      found.push({
+        line,
+        source: { pattern: hit.pattern, from: hit.from },
+        reason: `${hit.from} pattern "${hit.pattern}"`
+      });
+  }
+  return found;
+}
+var linesOf = (command, dialect) => {
+  try {
+    return commandLines(command, dialect);
+  } catch {
+    return null;
+  }
+};
+var quoteWord = (word) => /^[\w@%+=:,./-]+$/u.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`;
+var leaseCommand = (words) => `workit check --heavy -- ${words.map(quoteWord).join(" ")}`;
+function heavyPlan(command, options) {
+  const dialect = options.dialect ?? "posix";
+  if (dialect !== "posix" || !gitTop(options.cwd))
+    return { kind: "none" };
+  const lines = linesOf(command, dialect);
+  if (!lines)
+    return { kind: "none" };
+  const heavy = heavyLines(lines, options);
+  if (!heavy.length)
+    return { kind: "none" };
+  const simple = simpleCommand(command, dialect);
+  const single = simple && !WORKIT.test(baseName2(simple[0])) && heavyLines([simple], options)[0];
+  const judged = single ? [{ words: lines.flat(), text: command }] : heavy.map((match) => ({
+    words: match.line,
+    text: match.line.join(" ")
+  }));
+  if (options.rules !== null)
+    for (const { words, text } of judged) {
+      const verdict = wrapAllowed(options.rules, words, text, { bypass: options.bypass });
+      if (!verdict.ok)
+        return {
+          kind: "passthrough",
+          note: `workit: \`${command.trim()}\` is heavy but runs outside the heavy-check lease because a host permission rule names it (or \`workit\` is allowlisted); the host decides.`
+        };
+    }
+  if (single) {
+    const rewrite = leaseRewrite(command);
+    return rewrite ? { kind: "rewrite", command: rewrite, reason: single.reason } : { kind: "none" };
+  }
+  const parts = heavy.map((match) => leaseCommand(match.line));
+  return {
+    kind: "split",
+    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run each heavy part alone as \`workit check --heavy -- <segment>\` (here: ${parts.map((part) => `\`${part}\``).join("; ")}); run the other parts as their own commands.`,
+    unblock: parts[0] ?? null
+  };
+}
+function workitOnPath2(env = process.env) {
+  const names = process.platform === "win32" ? ["workit.exe", "workit.cmd", "workit"] : ["workit"];
+  for (const dir of (env.PATH ?? "").split(path23.delimiter))
+    for (const name of names) {
+      if (!dir)
+        continue;
+      try {
+        fs18.accessSync(path23.join(dir, name), fs18.constants.X_OK);
+        return true;
+      } catch {}
+    }
+  return false;
+}
+var ASSIGNMENTS = /^\s*((?:[A-Za-z_]\w*=(?:'[^']*'|"(?:[^"\\]|\\.)*"|[^\s'"])*\s+)*)/u;
+function leaseRewrite(command) {
+  const text = command.trim();
+  const prefix = ASSIGNMENTS.exec(text)?.[1] ?? "";
+  const rest = text.slice(prefix.length).trim();
+  if (!rest)
+    return null;
+  return `${prefix}workit check --heavy -- ${rest}`;
+}
+
+// packages/workit-core/src/core/heavy-words.ts
+import fs19 from "node:fs";
+import os8 from "node:os";
+import path24 from "node:path";
+var HEAVY_WORDS = new Set(("npm npx pnpm pnpx yarn bun bunx deno corepack make gmake docker podman nerdctl " + "python python3 py uv poetry pdm pipenv hatch rye bundle rake nx " + "jest vitest mocha ava tap karma jasmine nyc c8 tsc vue-tsc svelte-check eslint stylelint " + "tslint webpack webpack-cli rollup parcel tsup vite next nuxt nuxi astro ng react-scripts " + "playwright cypress wdio testcafe turbo lerna sonar-scanner sonarless sonarless-mcp go " + "golangci-lint gotestsum staticcheck cargo mvn mvnw gradle gradlew ant sbt bazel bazelisk " + "buck2 dotnet msbuild pytest py.test tox nox mypy pyright pylint coverage maturin pip pip3 " + "rspec rails phpunit pest phpstan psalm composer mix swift xcodebuild flutter dart pod cmake " + "ninja meson ctest scons docker-compose buildah earthly").split(" "));
+var wordsOf = (command) => command.split(/[\s;&|()<>`'"]+/u).map((word) => (word.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat)$/u, "")).filter(Boolean);
+var stateDir2 = (env) => {
+  if (env.WORKFLOW_TOOLKIT_STATE)
+    return env.WORKFLOW_TOOLKIT_STATE;
+  if (env.XDG_STATE_HOME)
+    return path24.join(env.XDG_STATE_HOME, "workit");
+  const home = env.HOME || os8.homedir();
+  if (process.platform === "darwin")
+    return path24.join(home, "Library", "Application Support", "workit");
+  if (process.platform === "win32")
+    return path24.join(env.LOCALAPPDATA ?? path24.join(home, "AppData", "Local"), "workit");
+  return path24.join(home, ".local", "state", "workit");
+};
+var readJson2 = (file) => {
+  try {
+    return JSON.parse(fs19.readFileSync(file, "utf8"));
+  } catch {
+    return;
+  }
+};
+var patternWords = (cwd, env) => {
+  const patterns = [];
+  const machine = readJson2(path24.join(stateDir2(env), "heavy-commands.json"));
+  if (Array.isArray(machine?.patterns))
+    patterns.push(...machine.patterns);
+  for (let dir = path24.resolve(cwd);; dir = path24.dirname(dir)) {
+    if (fs19.existsSync(path24.join(dir, ".git"))) {
+      patterns.push(...repoHeavyCommands(dir));
+      break;
+    }
+    if (path24.dirname(dir) === dir)
+      break;
+  }
+  const words = new Set;
+  for (const pattern of patterns) {
+    if (typeof pattern !== "string")
+      continue;
+    const first = wordsOf(pattern)[0];
+    if (!first || first.includes("*"))
+      return null;
+    words.add(first);
+  }
+  return words;
+};
+function maybeHeavy(command, cwd, env = process.env) {
+  try {
+    const words = wordsOf(command);
+    if (words.some((word) => HEAVY_WORDS.has(word) || /^python[\d.]*$/u.test(word)))
+      return true;
+    const extra = patternWords(cwd, env);
+    return extra === null || words.some((word) => extra.has(word));
+  } catch {
+    return true;
+  }
+}
+
+// packages/workit-core/src/hooks/heavy-gate.ts
+var rulesFor = (host, cwd, env) => {
+  switch (host) {
+    case "claude_code":
+      return claudeRules(cwd, env);
+    case "opencode":
+      return opencodeRules(cwd, env);
+    case "codex_cli":
+    case "codex_desktop":
+      return codexRules(cwd, env);
+    case "cursor":
+      return cursorRules(cwd, env);
+    case "pi":
+      return null;
+  }
+};
+function heavyGate(cwd, command, options) {
+  const env = options.env ?? process.env;
+  try {
+    if (env.WORKIT_HEAVY_GATE === "0" || !maybeHeavy(command, cwd, env) || !workitOnPath2(env))
+      return { kind: "none" };
+    return heavyPlan(command, {
+      cwd,
+      env,
+      dialect: options.dialect ?? "posix",
+      rules: rulesFor(options.host, cwd, env),
+      bypass: options.permissionMode === "bypassPermissions"
+    });
+  } catch {
+    return { kind: "none" };
+  }
+}
+var rewriteNote = (plan) => `workit: this heavy command (${plan.reason}) runs under the machine-wide heavy-check lease as \`${plan.command}\`: it waits while another heavy check holds the lease (\`workit lock status\` shows who). Run heavy commands that way yourself; \`workit help lock\` explains the lease.`;
+var heavyDenial = (original, plan) => ({
+  kind: "deny",
+  reason: `heavy_command: \`${original.trim()}\` is heavy (${plan.reason}) and must run under the machine-wide heavy-check lease, so parallel agents cannot exhaust this machine's memory and CPU. Run exactly: ${plan.command}`,
+  unblock: plan.command
+});
+var splitDenial = (plan) => ({
+  kind: "deny",
+  reason: plan.reason,
+  unblock: plan.unblock
+});
+// packages/workit-core/src/hooks/write-gate.ts
+import { realpathSync as realpathSync5 } from "node:fs";
+import os10 from "node:os";
+import path26 from "node:path";
 
 // packages/workit-core/src/core/live-session.ts
 import { spawnSync as spawnSync13 } from "node:child_process";
 import { createHash as createHash15 } from "node:crypto";
-import fs17 from "node:fs";
-import os6 from "node:os";
-import path22 from "node:path";
+import fs20 from "node:fs";
+import os9 from "node:os";
+import path25 from "node:path";
 var LIVE_SESSION_TTL_MS = 15 * 60000;
 var HEARTBEAT_EVERY_MS = 30000;
 var liveProbe = {
@@ -20408,9 +21291,9 @@ var processAlive = (pid) => {
 var processInfo = (pid) => {
   try {
     if (liveProbe.platform === "linux") {
-      const stat = fs17.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const stat = fs20.readFileSync(`/proc/${pid}/stat`, "utf8");
       const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
-      const command = fs17.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
+      const command = fs20.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
       return Number.isInteger(ppid) ? { ppid, command: command.trim() } : null;
     }
     if (liveProbe.platform === "win32")
@@ -20461,35 +21344,35 @@ var liveOwner = (input, transport, env = process.env) => {
   };
 };
 var checkoutOf = (target) => {
-  let dir = path22.resolve(target);
-  while (!fs17.existsSync(dir) && path22.dirname(dir) !== dir)
-    dir = path22.dirname(dir);
-  if (fs17.existsSync(dir) && !fs17.statSync(dir).isDirectory())
-    dir = path22.dirname(dir);
-  const parts = dir.split(path22.sep);
+  let dir = path25.resolve(target);
+  while (!fs20.existsSync(dir) && path25.dirname(dir) !== dir)
+    dir = path25.dirname(dir);
+  if (fs20.existsSync(dir) && !fs20.statSync(dir).isDirectory())
+    dir = path25.dirname(dir);
+  const parts = dir.split(path25.sep);
   const dotGit = parts.lastIndexOf(".git");
   if (dotGit > 0)
-    dir = parts.slice(0, dotGit).join(path22.sep) || path22.sep;
+    dir = parts.slice(0, dotGit).join(path25.sep) || path25.sep;
   const location = resolveStore(dir);
   if (location instanceof Error || !location.shared || !location.top)
     return null;
   let top = location.top;
   try {
-    top = fs17.realpathSync.native(top);
+    top = fs20.realpathSync.native(top);
   } catch {}
   return top;
 };
-var markerFile2 = (top) => path22.join(resolveStateDir(), "live-sessions", `${createHash15("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
+var markerFile2 = (top) => path25.join(resolveStateDir(), "live-sessions", `${createHash15("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
 var checkoutKey = (top, platform = process.platform) => {
-  let key = path22.resolve(top);
+  let key = path25.resolve(top);
   try {
-    key = fs17.realpathSync.native(key);
+    key = fs20.realpathSync.native(key);
   } catch {}
   return platform === "win32" ? key.replaceAll("/", "\\").toLowerCase() : key;
 };
 var readMarker = (file) => {
   try {
-    const value = JSON.parse(fs17.readFileSync(file, "utf8"));
+    const value = JSON.parse(fs20.readFileSync(file, "utf8"));
     if (value?.version !== 1 || typeof value.session !== "string" || typeof value.host !== "string" || typeof value.heartbeatAt !== "string" || Number.isNaN(Date.parse(value.heartbeatAt)))
       return null;
     return {
@@ -20512,7 +21395,7 @@ var isLive = (marker, deps) => {
   const age = ageOf2(marker, deps.now ?? new Date);
   if (age > (deps.ttlMs ?? LIVE_SESSION_TTL_MS))
     return false;
-  if (marker.machine !== (deps.machine ?? os6.hostname()) || marker.pid === null)
+  if (marker.machine !== (deps.machine ?? os9.hostname()) || marker.pid === null)
     return true;
   if (!(deps.alive ?? processAlive)(marker.pid))
     return false;
@@ -20541,7 +21424,7 @@ var liveConflict = (target, owner, deps = {}) => {
     const marker = readMarker(file);
     if (!marker || sameLead(marker, owner) || !isLive(marker, deps))
       return null;
-    if (sameOwner(marker, owner, deps.machine ?? os6.hostname()))
+    if (sameOwner(marker, owner, deps.machine ?? os9.hostname()))
       return null;
     return { marker, file, ageMs: ageOf2(marker, deps.now ?? new Date), checkout };
   } catch {
@@ -20555,7 +21438,7 @@ var claimLiveSession = (target, owner, deps = {}) => {
       return;
     const file = markerFile2(checkout);
     const now = deps.now ?? new Date;
-    const machine = deps.machine ?? os6.hostname();
+    const machine = deps.machine ?? os9.hostname();
     const current = readMarker(file);
     if (current) {
       const age = ageOf2(current, now);
@@ -20576,10 +21459,10 @@ var claimLiveSession = (target, owner, deps = {}) => {
       checkout,
       heartbeatAt: now.toISOString()
     };
-    fs17.mkdirSync(path22.dirname(file), { recursive: true });
+    fs20.mkdirSync(path25.dirname(file), { recursive: true });
     const temp = `${file}.${process.pid}.tmp`;
-    fs17.writeFileSync(temp, JSON.stringify(marker));
-    fs17.renameSync(temp, file);
+    fs20.writeFileSync(temp, JSON.stringify(marker));
+    fs20.renameSync(temp, file);
   } catch {}
 };
 
@@ -20588,27 +21471,42 @@ var NONE3 = { kind: "none" };
 var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
 var canonical2 = (file) => {
   let rest = "";
-  for (let dir = path23.resolve(file);; dir = path23.dirname(dir)) {
+  for (let dir = path26.resolve(file);; dir = path26.dirname(dir)) {
     try {
-      return path23.join(realpathSync5(dir), rest);
+      return path26.join(realpathSync5(dir), rest);
     } catch {
-      if (path23.dirname(dir) === dir)
-        return path23.resolve(file);
-      rest = rest ? path23.join(path23.basename(dir), rest) : path23.basename(dir);
+      if (path26.dirname(dir) === dir)
+        return path26.resolve(file);
+      rest = rest ? path26.join(path26.basename(dir), rest) : path26.basename(dir);
     }
   }
 };
 var exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path23.relative(fold(canonical2(root)), fold(canonical2(path23.resolve(cwd, file))));
-  if (relative.startsWith("..") || path23.isAbsolute(relative))
+  const relative = path26.relative(fold(canonical2(root)), fold(canonical2(path26.resolve(cwd, file))));
+  if (relative.startsWith("..") || path26.isAbsolute(relative))
     return true;
-  const posix = relative.split(path23.sep).join("/");
+  const posix = relative.split(path26.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
 var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
 var operands = (words) => words.filter((item) => !item.startsWith("-"));
+var SCRIPT_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+var wrappedScript = (input) => {
+  let words = input;
+  while (words.length && (PREFIXES2.has(words[0]) || /^\w+=/.test(words[0])))
+    words = words.slice(1);
+  const tail = workitCheckTail(words);
+  if (!tail)
+    return null;
+  if ("script" in tail)
+    return tail.script;
+  const [shell, flag, script] = tail.argv;
+  if (SCRIPT_SHELLS.has((shell.split(/[\\/]/).at(-1) ?? "").toLowerCase()) && /^-[a-z]*c$/.test(flag ?? ""))
+    return script ?? null;
+  return tail.argv.map(quoteWord2).join(" ");
+};
 var editsOf = (input) => {
   let words = input;
   while (words.length && (PREFIXES2.has(words[0]) || /^\w+=/.test(words[0])))
@@ -20685,10 +21583,18 @@ var editsOf = (input) => {
       return [];
   }
 };
-var shellWrites = (command) => {
+var shellWrites = (command, depth = 0) => {
   const targets = [];
   let unknown = false;
   for (const segment of segmentsOf(command)) {
+    const inner = depth < 4 ? wrappedScript(segment.words) : null;
+    if (inner !== null) {
+      const nested = shellWrites(inner, depth + 1);
+      if (nested.writes && nested.targets === null)
+        unknown = true;
+      else if (nested.targets)
+        targets.push(...nested.targets);
+    }
     targets.push(...segment.redirects.filter((item) => !/^\/dev\/(?:null|stdout|stderr|tty)$/.test(item)));
     const edits = editsOf(segment.words);
     if (edits === null)
@@ -20701,7 +21607,7 @@ var shellWrites = (command) => {
   return { writes: true, targets: unknown ? null : targets };
 };
 var cache2 = new Map;
-var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path23.resolve(root, file)) ?? "-").join("\x00");
+var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path26.resolve(root, file)) ?? "-").join("\x00");
 var gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
@@ -20780,7 +21686,7 @@ var gitMutationDirs = (cwd, command, dialect) => {
       return [];
     if (sub === "stash" && ["list", "show"].includes(rest[0] ?? ""))
       return [];
-    return [path23.resolve(cwd, invocation.dir ?? ".")];
+    return [path26.resolve(cwd, invocation.dir ?? ".")];
   });
 };
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
@@ -20790,15 +21696,15 @@ var cdInto = (dir, words) => {
   const target = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
   if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
     return;
-  return target === undefined ? os7.homedir() : path23.resolve(dir, target);
+  return target === undefined ? os10.homedir() : path26.resolve(dir, target);
 };
-var quoteWord = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
-var segmentTargets = (cwd, command, dialect) => {
+var quoteWord2 = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
+var segmentTargets = (cwd, command, dialect, depth = 0) => {
   const targets = [];
   let dir = cwd;
   let stack = [];
   const groups = [];
-  const at = (file) => path23.isAbsolute(file) ? file : dir === undefined ? null : path23.resolve(dir, file);
+  const at = (file) => path26.isAbsolute(file) ? file : dir === undefined ? null : path26.resolve(dir, file);
   for (const segment of segmentsOf(command, dialect)) {
     if (segment.group === "open") {
       groups.push({ dir, stack: [...stack] });
@@ -20826,6 +21732,9 @@ var segmentTargets = (cwd, command, dialect) => {
       dir = stack.length ? stack.pop() : undefined;
       continue;
     }
+    const inner = depth < 4 ? wrappedScript(words) : null;
+    if (inner !== null && dir !== undefined)
+      targets.push(...segmentTargets(dir, inner, "posix", depth + 1));
     for (const file of segment.redirects)
       if (!/^\/dev\/(?:null|stdout|stderr|tty)$/.test(file)) {
         const resolved = at(file);
@@ -20835,15 +21744,15 @@ var segmentTargets = (cwd, command, dialect) => {
     const edits = editsOf(segment.words);
     if (edits === null) {
       if (dir !== undefined)
-        targets.push(path23.join(dir, DIR_TARGET));
+        targets.push(path26.join(dir, DIR_TARGET));
     } else
       for (const file of edits) {
         const resolved = at(file);
         if (resolved)
           targets.push(resolved);
       }
-    if (dir !== undefined && workitInvocations(segment.words.map(quoteWord).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
-      targets.push(path23.join(dir, DIR_TARGET));
+    if (dir !== undefined && workitInvocations(segment.words.map(quoteWord2).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
+      targets.push(path26.join(dir, DIR_TARGET));
   }
   return targets;
 };
@@ -20878,7 +21787,7 @@ var liveDeny = ({ marker, checkout, ageMs, file }) => {
 var guarded = (targets) => {
   const seen = new Set;
   return targets.filter((target) => {
-    const dir = path23.dirname(target);
+    const dir = path26.dirname(target);
     if (seen.has(dir))
       return false;
     seen.add(dir);
@@ -20899,7 +21808,7 @@ var claimAll = (owner, targets, deps) => {
   for (const target of guarded(targets))
     claimLiveSession(target, owner, deps);
 };
-var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path23.resolve(cwd, file)) : [path23.join(cwd, DIR_TARGET)];
+var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path26.resolve(cwd, file)) : [path26.join(cwd, DIR_TARGET)];
 function writeGate(cwd, paths, owner, deps) {
   if (!owner)
     return beforeWriteGate(cwd, paths);
@@ -20919,7 +21828,7 @@ function shellGate(cwd, command, owner, dialect = "posix", deps) {
     try {
       targets = [
         ...segmentTargets(cwd, command, dialect),
-        ...gitMutationDirs(cwd, command, dialect).map((dir) => path23.join(dir, DIR_TARGET))
+        ...gitMutationDirs(cwd, command, dialect).map((dir) => path26.join(dir, DIR_TARGET))
       ];
     } catch {
       targets = [];
@@ -21353,12 +22262,12 @@ ${line}` };
 };
 // packages/workit-core/src/hooks/hosts/fields.ts
 import { existsSync as existsSync7, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
-import path24 from "node:path";
-var isRecord4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+import path27 from "node:path";
+var isRecord6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path24.isAbsolute(value) || !existsSync7(value))
+  if (!nonEmpty2(value) || !path27.isAbsolute(value) || !existsSync7(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -21411,7 +22320,7 @@ var isWriteTool = (name) => typeof name === "string" && WRITE_TOOLS.has(name.toL
 var PATH_KEYS = ["file_path", "filePath", "notebook_path", "path", "target_file", "file"];
 var PATCH_HEADER = /^[ \t]*\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/gm;
 var writePaths = (input) => {
-  if (!isRecord4(input))
+  if (!isRecord6(input))
     return [];
   const paths = PATH_KEYS.map((key) => input[key]).filter(nonEmpty2);
   for (const value of Object.values(input))
@@ -21506,10 +22415,32 @@ function handleHook(input, deps) {
       const gate = usable2(descriptor.events["write.pre"].support) ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect) : NONE5;
       if (gate.kind === "deny")
         return gate;
+      const plan = heavyGate(input.cwd, event.command, {
+        host: input.host,
+        dialect: event.dialect,
+        permissionMode: input.permissionMode
+      });
+      if (plan.kind === "split" && canDeny)
+        return splitDenial(plan);
+      const rewrites = usable2(descriptor.shellPolicy.rewrite);
+      if (plan.kind === "rewrite" && !rewrites && canDeny)
+        return heavyDenial(event.command, plan);
+      const lease = plan.kind === "rewrite" && rewrites ? plan : null;
+      const aside = plan.kind === "passthrough" ? plan.note : null;
       noteRawCommit(input, event.command, postTool ? callKey(event.toolUseId, event.command) : NEXT_COMMAND);
+      const rewritten = (text) => lease ? {
+        kind: "rewrite",
+        command: lease.command,
+        input: event.toolInput ? { ...event.toolInput, command: lease.command } : null,
+        text
+      } : NONE5;
       if (descriptor.transport !== "hook-process")
-        return NONE5;
-      return withContextLine(canDeny ? rawGitPre(input, event.command) : NONE5, shipNudge(input, event.command));
+        return rewritten(null);
+      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE5, aside), shipNudge(input, event.command));
+      if (!lease)
+        return nudged;
+      return rewritten([rewriteNote(lease), nudged.kind === "context" ? nudged.text : null].filter(Boolean).join(`
+`));
     }
     case "shell.post":
       if (usable2(descriptor.events["shell.post"].support))
@@ -21587,7 +22518,12 @@ var CLAUDE_CODE_DESCRIPTOR = {
     "compact.pre": { support: "none", native: null },
     stop: { support: "native", native: "Stop" }
   },
-  shellPolicy: { deny: "native", channel: "permissionDecision", failClosed: false },
+  shellPolicy: {
+    deny: "native",
+    channel: "permissionDecision",
+    failClosed: false,
+    rewrite: "native"
+  },
   context: {
     sessionStart: "native",
     perTurn: "native",
@@ -21669,7 +22605,7 @@ var EVENTS = {
 var SOURCES = new Set(["startup", "resume", "clear", "compact", "fork"]);
 var SHELL_TOOLS = new Set(["Bash", "PowerShell"]);
 var dialectOf2 = (value) => value.tool_name === "PowerShell" ? "powershell" : "posix";
-var toolCommand = (value) => isRecord4(value.tool_input) ? commandText(value.tool_input.command) : null;
+var toolCommand = (value) => isRecord6(value.tool_input) ? commandText(value.tool_input.command) : null;
 var eventOf = (name, value) => {
   const toolUseId = optionalText(value.tool_use_id);
   switch (name) {
@@ -21697,19 +22633,28 @@ var eventOf = (name, value) => {
             kind: "tool.pre",
             tool: value.tool_name,
             toolUseId,
-            skill: isRecord4(value.tool_input) ? optionalText(value.tool_input.skill) : null
+            skill: isRecord6(value.tool_input) ? optionalText(value.tool_input.skill) : null
           }
         };
       if (!SHELL_TOOLS.has(value.tool_name))
         return { ok: true, event: { kind: "tool.pre", tool: value.tool_name, toolUseId } };
       const command = toolCommand(value);
-      return command ? { ok: true, event: { kind: "shell.pre", command, toolUseId, dialect: dialectOf2(value) } } : { ok: false, error: `tool_input.command is required for ${value.tool_name}` };
+      return command ? {
+        ok: true,
+        event: {
+          kind: "shell.pre",
+          command,
+          toolUseId,
+          dialect: dialectOf2(value),
+          toolInput: value.tool_input
+        }
+      } : { ok: false, error: `tool_input.command is required for ${value.tool_name}` };
     }
     case "PostToolUse": {
       const command = toolCommand(value);
       if (!SHELL_TOOLS.has(String(value.tool_name)) || !command)
         return { ok: false, error: "only shell PostToolUse is mapped" };
-      const response = isRecord4(value.tool_response) ? value.tool_response : {};
+      const response = isRecord6(value.tool_response) ? value.tool_response : {};
       return {
         ok: true,
         event: {
@@ -21767,6 +22712,17 @@ var CONTEXT_EVENTS = new Set([
   "PostToolUse"
 ]);
 var render = (decision, native) => {
+  if (decision.kind === "rewrite" && native === "PreToolUse" && decision.input)
+    return {
+      json: {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          updatedInput: decision.input,
+          ...decision.text ? { additionalContext: decision.text } : {}
+        }
+      },
+      exitCode: 0
+    };
   if (decision.kind === "deny" && native === "PreToolUse")
     return {
       json: {
@@ -21792,14 +22748,14 @@ var render = (decision, native) => {
 var claudeCodeAdapter = {
   descriptor: CLAUDE_CODE_DESCRIPTOR,
   parse(raw) {
-    const native = isRecord4(raw) && Object.hasOwn(EVENTS, String(raw.hook_event_name)) ? raw.hook_event_name : null;
+    const native = isRecord6(raw) && Object.hasOwn(EVENTS, String(raw.hook_event_name)) ? raw.hook_event_name : null;
     const fail = (error) => ({
       ok: false,
       error,
       native,
       event: native ? EVENTS[native] : null
     });
-    if (!isRecord4(raw) || !native)
+    if (!isRecord6(raw) || !native)
       return fail("hook_event_name is required");
     if (!nonEmpty2(raw.session_id))
       return fail("session_id is required");
@@ -21853,7 +22809,12 @@ var CODEX_DESCRIPTOR = {
     "compact.pre": { support: "none", native: null },
     stop: { support: "native", native: "Stop" }
   },
-  shellPolicy: { deny: "native", channel: "permissionDecision", failClosed: false },
+  shellPolicy: {
+    deny: "native",
+    channel: "permissionDecision",
+    failClosed: false,
+    rewrite: "none"
+  },
   context: {
     sessionStart: "native",
     perTurn: "native",
@@ -21945,7 +22906,7 @@ var SHELL_TOOLS2 = new Set(["bash", "unified-exec"]);
 var isShellTool = (name) => SHELL_TOOLS2.has(String(name).toLowerCase());
 var SOURCES2 = new Set(["startup", "resume", "clear", "compact", "fork"]);
 var parseCodexHookInput = (value) => {
-  if (!isRecord4(value) || !Object.hasOwn(EVENTS2, String(value.hook_event_name)))
+  if (!isRecord6(value) || !Object.hasOwn(EVENTS2, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
   const event = value.hook_event_name;
   const cwd = existingDirectory(value.cwd);
@@ -21954,7 +22915,7 @@ var parseCodexHookInput = (value) => {
   const toolEvent = event === "PreToolUse" || event === "PostToolUse";
   if (toolEvent && !nonEmpty2(value.tool_name))
     return { ok: false, error: "tool_name is required" };
-  const command = isRecord4(value.tool_input) ? commandText(value.tool_input.command) : null;
+  const command = isRecord6(value.tool_input) ? commandText(value.tool_input.command) : null;
   if (toolEvent && isShellTool(value.tool_name) && !command)
     return { ok: false, error: "tool_input.command is required for shell tools" };
   if (event === "SubagentStart" && !nonEmpty2(value.agent_id))
@@ -22068,7 +23029,7 @@ var codexAdapter = {
     const host = detectCodexSurface(env);
     const parsed = parseCodexHookInput(raw);
     if (!parsed.ok) {
-      const native = isRecord4(raw) && Object.hasOwn(EVENTS2, String(raw.hook_event_name)) ? raw.hook_event_name : null;
+      const native = isRecord6(raw) && Object.hasOwn(EVENTS2, String(raw.hook_event_name)) ? raw.hook_event_name : null;
       return { ok: false, error: parsed.error, native, event: native ? EVENTS2[native] : null };
     }
     const input = parsed.data;
@@ -22095,8 +23056,8 @@ var codexAdapter = {
 };
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import fs18 from "node:fs";
-import path25 from "node:path";
+import fs21 from "node:fs";
+import path28 from "node:path";
 var undocumented = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
@@ -22118,7 +23079,7 @@ var CURSOR_DESCRIPTOR = {
     "compact.pre": { support: "partial", native: "preCompact" },
     stop: { support: "native", native: "stop" }
   },
-  shellPolicy: { deny: "native", channel: "exit2+json", failClosed: false },
+  shellPolicy: { deny: "native", channel: "exit2+json", failClosed: false, rewrite: "none" },
   context: {
     sessionStart: "native",
     perTurn: "none",
@@ -22211,7 +23172,7 @@ var EVENTS3 = {
   stop: "stop"
 };
 var parseCursorHookInput = (value) => {
-  if (!isRecord4(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
+  if (!isRecord6(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
   const roots = value.workspace_roots;
   if (!Array.isArray(roots) || roots.length === 0 || !roots.every(nonEmpty2))
@@ -22293,17 +23254,17 @@ var protocolEvent2 = (input) => {
 };
 var TRANSCRIPT_TAIL_BYTES = 256 * 1024;
 var lastAssistantText = (file) => {
-  if (!file || !path25.isAbsolute(file))
+  if (!file || !path28.isAbsolute(file))
     return null;
   try {
-    const size = fs18.statSync(file).size;
+    const size = fs21.statSync(file).size;
     const start = Math.max(0, size - TRANSCRIPT_TAIL_BYTES);
     const buffer = Buffer.alloc(size - start);
-    const fd = fs18.openSync(file, "r");
+    const fd = fs21.openSync(file, "r");
     try {
-      fs18.readSync(fd, buffer, 0, buffer.length, start);
+      fs21.readSync(fd, buffer, 0, buffer.length, start);
     } finally {
-      fs18.closeSync(fd);
+      fs21.closeSync(fd);
     }
     const lines = buffer.toString("utf8").split(`
 `);
@@ -22314,14 +23275,14 @@ var lastAssistantText = (file) => {
       } catch {
         continue;
       }
-      if (!isRecord4(entry) || entry.role !== "assistant")
+      if (!isRecord6(entry) || entry.role !== "assistant")
         continue;
-      const content = isRecord4(entry.message) ? entry.message.content : entry.content;
+      const content = isRecord6(entry.message) ? entry.message.content : entry.content;
       if (typeof content === "string")
         return content;
       if (!Array.isArray(content))
         return null;
-      const text = content.filter((part) => isRecord4(part) && part.type === "text" && typeof part.text === "string").map((part) => part.text).join(`
+      const text = content.filter((part) => isRecord6(part) && part.type === "text" && typeof part.text === "string").map((part) => part.text).join(`
 `);
       return text || null;
     }
@@ -22330,7 +23291,7 @@ var lastAssistantText = (file) => {
     return null;
   }
 };
-var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path25.sep) ? root : `${root}${path25.sep}`);
+var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path28.sep) ? root : `${root}${path28.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
@@ -22371,7 +23332,7 @@ var cursorAdapter = {
   parse(raw) {
     const parsed = parseCursorHookInput(raw);
     if (!parsed.ok) {
-      const native = isRecord4(raw) && Object.hasOwn(EVENTS3, String(raw.hook_event_name)) ? raw.hook_event_name : null;
+      const native = isRecord6(raw) && Object.hasOwn(EVENTS3, String(raw.hook_event_name)) ? raw.hook_event_name : null;
       return { ok: false, error: parsed.error, native, event: native ? EVENTS3[native] : null };
     }
     const input = parsed.data;