@brainervirus/workit-cursor 8.17.1 → 8.19.0

package/dist/cursor-session-start.js

@@ -10331,6 +10331,221 @@ var init_vcs_config = __esm(() => {
   TRACKERS = new Set(["github", "gitlab", "youtrack"]);
 });
 
+// packages/workit-core/src/core/commit-flavors.ts
+var init_commit_flavors = () => {};
+
+// packages/workit-core/src/core/git.ts
+var init_git = () => {};
+
+// packages/workit-core/src/core/branch.ts
+import { createHash as createHash6 } from "node:crypto";
+function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
+  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
+  const config = readConfig();
+  return kind === "branch" ? {
+    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(workspaceRoot))),
+    provenance: { branchPolicy: selected.source }
+  } : {
+    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
+    provenance: { commitPolicy: selected.source }
+  };
+}
+var withReleaseTracks = (workspaceRoot, policy) => {
+  const read = workspaceReleaseTracks(workspaceRoot);
+  if (read.error)
+    throw new ReleaseTrackError(read.error);
+  if (read.tracks.length === 0 && read.protectedBranches.length === 0)
+    return policy;
+  const known = new Set(policy.allowed.map((pattern) => pattern.source));
+  const allowed = [...policy.allowed];
+  for (const glob of read.tracks.flatMap((track) => Object.values(track.naming).map(namingGlob))) {
+    const pattern = branchGlobPattern(glob);
+    if (!known.has(pattern.source)) {
+      known.add(pattern.source);
+      allowed.push(pattern);
+    }
+  }
+  return {
+    ...policy,
+    allowed,
+    protected: new Set([
+      ...policy.protected,
+      ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
+    ])
+  };
+}, KIND_SYNONYMS, allowedKinds = (allowed) => [
+  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
+], editDistance = (a, b) => {
+  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (let i = 1;i <= a.length; i++) {
+    let previous = row[0];
+    row[0] = i;
+    for (let j = 1;j <= b.length; j++) {
+      const saved = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+      previous = saved;
+    }
+  }
+  return row[b.length];
+}, suggestBranchName = (name, kinds) => {
+  if (!kinds.length)
+    return null;
+  const slash = name.indexOf("/");
+  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
+  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
+  const synonym = KIND_SYNONYMS[prefix];
+  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
+  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
+  return `${kind}/${rest}`;
+}, kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", "), aliasNote = (kinds) => {
+  const notes = [
+    ["fix", "bugfix"],
+    ["chore", "feature"]
+  ].filter(([, kind]) => kinds.includes(kind)).map(([alias, kind]) => `${alias}/ is ${kind}/`);
+  return notes.length ? ` (${notes.join(", ")})` : "";
+}, validateBranchNamePolicy = (name, policy, source) => {
+  const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
+  const kinds = allowedKinds(policy.allowed);
+  if (policy.protected.has(name.toLowerCase())) {
+    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
+    return {
+      ok: false,
+      rule: "protected_ref",
+      source,
+      attempted: name,
+      correction,
+      error: `protected_ref: branch ${JSON.stringify(name)} is protected by ${source}; ${correction}`
+    };
+  }
+  if (!policy.allowed.some((pattern) => pattern.test(name))) {
+    const suggestion = suggestBranchName(name, kinds);
+    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
+    return {
+      ok: false,
+      rule: "allowed_pattern",
+      source,
+      attempted: name,
+      correction,
+      error: `allowed_pattern: branch ${JSON.stringify(name)} violates ${source} policy; ${correction}`
+    };
+  }
+  return { ok: true };
+}, branchPolicySnapshotFor = (workspaceRoot) => {
+  const resolved = effectiveWorkspacePolicy(workspaceRoot, "branch");
+  const branchPolicy = resolved.branchPolicy;
+  const source = resolved.provenance.branchPolicy;
+  const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
+  const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
+  const fingerprint = createHash6("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
+  return {
+    branchPolicy,
+    namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
+    source,
+    fingerprint
+  };
+}, validateBranchNameFor = (workspaceRoot, name) => {
+  try {
+    const resolved = branchPolicySnapshotFor(workspaceRoot);
+    return validateBranchNamePolicy(name, resolved.namePolicy, resolved.source);
+  } catch (error) {
+    const correction = "repair or select a valid workspace policy before creating a branch";
+    return {
+      ok: false,
+      rule: "policy_unavailable",
+      source: "workspaces.json",
+      attempted: name,
+      correction,
+      error: `policy_unavailable: cannot validate branch ${JSON.stringify(name)} because ${error instanceof Error ? error.message : String(error)}; ${correction}`
+    };
+  }
+}, resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy, gitFlowOf = (root, integration) => {
+  try {
+    if (resolveBranchPolicyFor(root).preset !== "gitflow")
+      return null;
+    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    const names = branchNames(root);
+    const production = productionBranchOf(names);
+    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
+    return { develop, production, developExists: names.has(develop) };
+  } catch {
+    return null;
+  }
+}, releaseBranchesOf = (cwd) => {
+  try {
+    const resolved = resolveBranchPolicyFor(cwd);
+    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
+    return {
+      preset: resolved.preset,
+      branches: flow ? [flow.production, flow.develop] : [],
+      production: flow ? flow.production : resolved.defaultTargetBranch
+    };
+  } catch {
+    return { preset: "unknown", branches: [], production: null };
+  }
+}, releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase()), branchGuidance = (cwd) => {
+  try {
+    const patterns = branchPolicySnapshotFor(cwd).namePolicy.allowed;
+    const kinds = allowedKinds(patterns);
+    const kindShaped = new Set(kinds.map((kind) => branchGlobPattern(`${kind}/*`).source));
+    const anyName = patterns.some((pattern) => pattern.source === "^.*$");
+    const others = patterns.filter((pattern) => !kindShaped.has(pattern.source)).map((pattern) => globOf(pattern));
+    const allowed = anyName ? "Any non-protected branch name is allowed here." : `${kinds.length ? `Allowed branch kinds here: ${kindList(kinds)}${aliasNote(kinds)}` : "Allowed branch names here:"}${others.length ? `${kinds.length ? "; also" : ""} names matching ${others.join(", ")}` : ""}; anything else is denied.`;
+    const resolved = vcsConfig("resolve", cwd);
+    const integration = resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
+    const flow = resolved.releaseTrack?.track ? null : gitFlowOf(cwd, integration);
+    if (flow?.developExists)
+      return `${allowed} git-flow: feature/, bugfix/ and release/ start from origin/${flow.develop}, hotfix/ from origin/${flow.production}; feature/ and bugfix/ land on ${flow.develop}, release/ and hotfix/ on ${flow.production}.`;
+    const names = branchNames(cwd);
+    const configured = String(resolved.baseBranch ?? integration ?? "") || null;
+    const trunk = productionBranchOf(names);
+    const base = configured && names.has(configured) ? `Branch from origin/${configured}.` : names.has(trunk) ? `Branch from origin/${trunk}${configured ? ` (the default target ${configured} does not exist here)` : ""}.` : "No base branch exists here yet; pass the base explicitly.";
+    return `${allowed} ${base}`;
+  } catch {
+    return null;
+  }
+}, globOf = (pattern) => pattern.source.replace(/^\^|\$$/gu, "").replaceAll(".*", "*").replace(/\\(.)/gu, "$1"), policy = (root) => resolveBranchPolicyFor(root), isProtected = (root, name) => policy(root).protected.has(name.toLowerCase()), isProtectedTarget = (root, name) => {
+  try {
+    return isProtected(root, name);
+  } catch {
+    return true;
+  }
+};
+var init_branch = __esm(() => {
+  init_branch_policy();
+  init_commit_flavors();
+  init_git();
+  init_config();
+  init_workspaces();
+  init_vcs_config();
+  init_release_tracks();
+  KIND_SYNONYMS = {
+    fix: "bugfix",
+    fixes: "bugfix",
+    bug: "bugfix",
+    bugs: "bugfix",
+    bugfixes: "bugfix",
+    feat: "feature",
+    features: "feature",
+    chore: "feature",
+    docs: "feature",
+    doc: "feature",
+    refactor: "feature",
+    test: "feature",
+    tests: "feature",
+    ci: "feature",
+    build: "feature",
+    perf: "feature",
+    style: "feature",
+    deps: "feature",
+    task: "feature",
+    enhancement: "feature",
+    hot: "hotfix",
+    hotfixes: "hotfix",
+    releases: "release",
+    rel: "release"
+  };
+});
+
 // packages/workit-core/src/core/logger.ts
 import os3 from "node:os";
 import path6 from "node:path";
@@ -10392,7 +10607,7 @@ var init_logger = __esm(() => {
 });
 
 // packages/workit-core/src/host-session.ts
-import { createHash as createHash6, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash as createHash7, randomBytes, timingSafeEqual } from "node:crypto";
 import fs5 from "node:fs";
 import path7 from "node:path";
 function hostSessionFromEnv(env) {
@@ -10467,6 +10682,21 @@ function recordIssuedSession(cwd, lead, issued) {
     return null;
   }
 }
+function judgeBranch(cwd) {
+  const branch = currentBranch(cwd);
+  return branch && !isProtectedTarget(cwd, branch) ? branch : null;
+}
+function verdictCommand(options) {
+  const kind = options.judge === "verifier" ? "<live|unit>" : options.judge === "reviewer" ? "review" : "<live|unit|review>";
+  return [
+    "workit ledger verdict <verified|failed|blocked>",
+    `--kind ${kind}`,
+    `--branch ${options.branch ?? "<branch>"}`,
+    options.session ? `--session ${options.session}` : null,
+    options.token ? `--token=${options.token}` : null,
+    '--how "<what you ran and saw>"'
+  ].filter(Boolean).join(" ");
+}
 function pruneIssued(dir, own, tokens) {
   try {
     const entries = fs5.readdirSync(dir);
@@ -10488,7 +10718,7 @@ function issuedBinding(cwd, claimed) {
     return null;
   return leadBound ? "token" : "legacy";
 }
-var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, ISSUED_PER_LEAD = 64, ISSUED_SESSIONS_MARKER = "workit-issued-sessions/3", hash = (value) => createHash6("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path7.join(resolveStateDir(), "issued"), userTokenRoot = () => path7.join(resolveStateDir(), "issued-tokens"), safeList = (dir) => {
+var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, ISSUED_PER_LEAD = 64, ISSUED_SESSIONS_MARKER = "workit-issued-sessions/3", hash = (value) => createHash7("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path7.join(resolveStateDir(), "issued"), userTokenRoot = () => path7.join(resolveStateDir(), "issued-tokens"), safeList = (dir) => {
   try {
     return fs5.readdirSync(dir);
   } catch {
@@ -10498,7 +10728,7 @@ var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "")
   try {
     fs5.rmdirSync(dir);
   } catch {}
-}, tokenHash = (token) => createHash6("sha256").update(token).digest("hex"), issuedRecord = (cwd, claimed) => {
+}, tokenHash = (token) => createHash7("sha256").update(token).digest("hex"), issuedRecord = (cwd, claimed) => {
   const cut = claimed.lastIndexOf(":");
   if (cut <= 0)
     return null;
@@ -10521,7 +10751,9 @@ var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "")
   }
 }, OWN_CHILD_SHELL;
 var init_host_session = __esm(() => {
+  init_branch();
   init_logger();
+  init_rev();
   init_paths();
   HOST_SESSION_VARS = [
     ["OPENCODE_SESSION_ID", () => "opencode"],
@@ -10537,7 +10769,7 @@ var init_host_session = __esm(() => {
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { createHash as createHash7, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash8, randomBytes as randomBytes2 } from "node:crypto";
 import fs6 from "node:fs";
 import path8 from "node:path";
 function resolveCommit(cwd, ref) {
@@ -10593,7 +10825,7 @@ function diffHash(cwd, base, head) {
   ], GIT_TIMEOUTS.worktree);
   if (!diff.ok || !diff.stdout)
     return null;
-  const hash = createHash7("sha256");
+  const hash = createHash8("sha256");
   for (const line of diff.stdout.split(`
 `)) {
     if (line.startsWith("index "))
@@ -11196,7 +11428,7 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, PASSING, FAILING, STRONG_RESULTS,
     } catch {}
   }
   return null;
-}, ledgerLock, sha2562 = (text) => createHash7("sha256").update(text).digest("hex"), chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
+}, ledgerLock, sha2562 = (text) => createHash8("sha256").update(text).digest("hex"), chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
 ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
   for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
     const buffer = Buffer.alloc(span);
@@ -11526,7 +11758,7 @@ var RULES, derived2 = (spec) => ({
     };
   const since = Date.parse(task.createdAt);
   const branch = ledger.branch();
-  const row = ledger.rows().findLast((item) => item.type === "decision" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
+  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
   return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
     met: false,
     reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
@@ -13162,7 +13394,7 @@ var isPlainObject2 = (value) => typeof value === "object" && value !== null && !
 });
 
 // packages/workit-core/src/store/reduce.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 function reduce(state, event, blobs) {
   const data = event.data;
   const known = KNOWN_TYPES.has(event.type);
@@ -13229,7 +13461,7 @@ function eventType(before, after) {
     return "task.noted";
   return "task.updated";
 }
-var OPENING_TYPES, KNOWN_TYPES, isObject5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), isKey = (value) => isObject5(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string"), BLOB_REF = "$blob", blobRef = (value) => isObject5(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null, blobDigest = (value) => createHash8("sha256").update(JSON.stringify(value)).digest("hex"), toBlob = (value, blobs) => {
+var OPENING_TYPES, KNOWN_TYPES, isObject5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), isKey = (value) => isObject5(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string"), BLOB_REF = "$blob", blobRef = (value) => isObject5(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null, blobDigest = (value) => createHash9("sha256").update(JSON.stringify(value)).digest("hex"), toBlob = (value, blobs) => {
   if (!isObject5(value))
     return value;
   const digest = blobDigest(value);
@@ -13300,7 +13532,7 @@ var init_notes = __esm(() => {
 });
 
 // packages/workit-core/src/core/task-store.ts
-import { createHash as createHash9, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash10, randomUUID as randomUUID3 } from "node:crypto";
 import * as fs11 from "node:fs";
 import path15 from "node:path";
 
@@ -14264,7 +14496,7 @@ class TaskStore {
     return bound.ok ? success(null, null, bound.data[0] ?? null) : bound;
   }
   withKeyLock(key, operation) {
-    const digest = createHash9("sha256").update(key).digest("hex").slice(0, 32);
+    const digest = createHash10("sha256").update(key).digest("hex").slice(0, 32);
     return this.withLock(path15.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
@@ -15033,6 +15265,11 @@ var init_workers = __esm(() => {
 import { spawnSync as spawnSync9 } from "node:child_process";
 import fs12 from "node:fs";
 import path16 from "node:path";
+function checksConfigFile(root) {
+  const current = path16.join(root, CHECKS_FILE);
+  const legacy = path16.join(root, LEGACY_CHECKS_FILE);
+  return !fs12.existsSync(current) && fs12.existsSync(legacy) ? legacy : current;
+}
 function repoHeavyCommands(root) {
   try {
     const value = JSON.parse(fs12.readFileSync(checksConfigFile(root), "utf8"));
@@ -15124,19 +15361,25 @@ function detectedChecks(root) {
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = checksConfigFile(root);
+  const legacy = path16.basename(file) === LEGACY_CHECKS_FILE;
+  const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
+  const note = legacy ? {
+    note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
+  } : {};
   const none = (error = null) => ({
-    source: error ? CHECKS_FILE : "none",
+    source: error ? label : "none",
     root,
     checks: [],
     gates: {},
-    error
+    error,
+    ...note
   });
   let text = null;
   try {
     text = fs12.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
-      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+      return none(`cannot read ${label}: ${error.message}`);
   }
   if (text === null) {
     const checks = detectedChecks(root);
@@ -15146,33 +15389,33 @@ function loadCheckConfig(cwd) {
   try {
     parsed = JSON.parse(text);
   } catch {
-    return none(`${CHECKS_FILE} is not valid JSON`);
+    return none(`${label} is not valid JSON`);
   }
   if (!isRecord3(parsed) || !isRecord3(parsed.checks))
-    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+    return none(`${label} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
   const checks = [];
   for (const [name, value] of Object.entries(parsed.checks)) {
     if (!CHECK_NAME.test(name))
-      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+      return none(`${label}: check name "${name}" must match ${CHECK_NAME.source}`);
     const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
     if (argv instanceof Error)
-      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+      return none(`${label}: check "${name}": ${argv.message}`);
     checks.push({ name, argv, accepts: [argv] });
   }
   const gates = {};
   if (parsed.gates !== undefined) {
     if (!isRecord3(parsed.gates))
-      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+      return none(`${label}: gates must be {"testing":"<name>"|["<name>",…]}`);
     for (const [gate, value] of Object.entries(parsed.gates)) {
       if (!GATES.includes(gate))
-        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+        return none(`${label}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
       const names = typeof value === "string" ? [value] : value;
       if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
-        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+        return none(`${label}: gates.${gate} must name configured checks`);
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
+  return { source: label, root, checks, gates, error: null, ...note, resources: parsed.resources };
 }
 function matchesNamedCheck(config, name, argv, cwd) {
   if (config.error || name === null || cwd !== ".")
@@ -15207,7 +15450,7 @@ function workitAvailable(env = process.env) {
 function checkCommand(args, version, onPath = workitAvailable()) {
   return onPath ? `workit check ${args}` : `npx -y @brainervirus/workit-cli@${version} check ${args}`;
 }
-var SCRIPT_CHECKS, CHECKS_FILE = "workit.checks.json", checksConfigFile = (root) => path16.join(root, CHECKS_FILE), isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SHELL_META, git4 = (cwd, args) => {
+var SCRIPT_CHECKS, CHECKS_FILE = ".workit/checks.json", LEGACY_CHECKS_FILE = "workit.checks.json", isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SHELL_META, git4 = (cwd, args) => {
   const run = spawnSync9("git", args, {
     cwd,
     encoding: "utf8",
@@ -15241,7 +15484,7 @@ var init_check_config = __esm(() => {
 });
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
 import path17 from "node:path";
@@ -15423,7 +15666,7 @@ function evaluateObservedGate(task, requirement, statuses, config) {
     return {
       satisfied: [],
       considered,
-      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE}, e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
     };
   const satisfied = fresh.filter(named);
   if (satisfied.length)
@@ -15695,7 +15938,7 @@ function boundTaskSummary(summary) {
   brief.truncated = JSON.stringify(brief).includes("…") || progress.blockers.length > BRIEF_BLOCKERS || unmet.length > BRIEF_OPEN;
   return brief;
 }
-var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`), relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".", canonicalPath = (value) => {
+var digestBytes = (value) => createHash11("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`), relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".", canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
@@ -17861,7 +18104,7 @@ var support = (descriptor, axis) => {
 });
 
 // packages/workit-core/src/hooks/context.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import fs14 from "node:fs";
 import path18 from "node:path";
 function sessionCompactContext(store, session, context, selection = "session-bound") {
@@ -17996,7 +18239,7 @@ ${options.addendum}` : ""}
   } catch {
     return null;
   }
-}, TURN_TTL_MS, digestOf = (text) => createHash11("sha256").update(text).digest("hex"), turnMarker = (input) => {
+}, TURN_TTL_MS, digestOf = (text) => createHash12("sha256").update(text).digest("hex"), turnMarker = (input) => {
   if (!input.session.id)
     return null;
   try {
@@ -18070,215 +18313,6 @@ var init_context = __esm(() => {
   TURN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 });
 
-// packages/workit-core/src/core/commit-flavors.ts
-var init_commit_flavors = () => {};
-
-// packages/workit-core/src/core/git.ts
-var init_git = () => {};
-
-// packages/workit-core/src/core/branch.ts
-import { createHash as createHash12 } from "node:crypto";
-function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
-  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
-  const config = readConfig();
-  return kind === "branch" ? {
-    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(workspaceRoot))),
-    provenance: { branchPolicy: selected.source }
-  } : {
-    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
-    provenance: { commitPolicy: selected.source }
-  };
-}
-var withReleaseTracks = (workspaceRoot, policy) => {
-  const read = workspaceReleaseTracks(workspaceRoot);
-  if (read.error)
-    throw new ReleaseTrackError(read.error);
-  if (read.tracks.length === 0 && read.protectedBranches.length === 0)
-    return policy;
-  const known = new Set(policy.allowed.map((pattern) => pattern.source));
-  const allowed = [...policy.allowed];
-  for (const glob of read.tracks.flatMap((track) => Object.values(track.naming).map(namingGlob))) {
-    const pattern = branchGlobPattern(glob);
-    if (!known.has(pattern.source)) {
-      known.add(pattern.source);
-      allowed.push(pattern);
-    }
-  }
-  return {
-    ...policy,
-    allowed,
-    protected: new Set([
-      ...policy.protected,
-      ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
-    ])
-  };
-}, KIND_SYNONYMS, allowedKinds = (allowed) => [
-  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
-], editDistance = (a, b) => {
-  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
-  for (let i = 1;i <= a.length; i++) {
-    let previous = row[0];
-    row[0] = i;
-    for (let j = 1;j <= b.length; j++) {
-      const saved = row[j];
-      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
-      previous = saved;
-    }
-  }
-  return row[b.length];
-}, suggestBranchName = (name, kinds) => {
-  if (!kinds.length)
-    return null;
-  const slash = name.indexOf("/");
-  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
-  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
-  const synonym = KIND_SYNONYMS[prefix];
-  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
-  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
-  return `${kind}/${rest}`;
-}, kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", "), aliasNote = (kinds) => {
-  const notes = [
-    ["fix", "bugfix"],
-    ["chore", "feature"]
-  ].filter(([, kind]) => kinds.includes(kind)).map(([alias, kind]) => `${alias}/ is ${kind}/`);
-  return notes.length ? ` (${notes.join(", ")})` : "";
-}, validateBranchNamePolicy = (name, policy, source) => {
-  const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
-  const kinds = allowedKinds(policy.allowed);
-  if (policy.protected.has(name.toLowerCase())) {
-    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
-    return {
-      ok: false,
-      rule: "protected_ref",
-      source,
-      attempted: name,
-      correction,
-      error: `protected_ref: branch ${JSON.stringify(name)} is protected by ${source}; ${correction}`
-    };
-  }
-  if (!policy.allowed.some((pattern) => pattern.test(name))) {
-    const suggestion = suggestBranchName(name, kinds);
-    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
-    return {
-      ok: false,
-      rule: "allowed_pattern",
-      source,
-      attempted: name,
-      correction,
-      error: `allowed_pattern: branch ${JSON.stringify(name)} violates ${source} policy; ${correction}`
-    };
-  }
-  return { ok: true };
-}, branchPolicySnapshotFor = (workspaceRoot) => {
-  const resolved = effectiveWorkspacePolicy(workspaceRoot, "branch");
-  const branchPolicy = resolved.branchPolicy;
-  const source = resolved.provenance.branchPolicy;
-  const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
-  const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
-  const fingerprint = createHash12("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
-  return {
-    branchPolicy,
-    namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
-    source,
-    fingerprint
-  };
-}, validateBranchNameFor = (workspaceRoot, name) => {
-  try {
-    const resolved = branchPolicySnapshotFor(workspaceRoot);
-    return validateBranchNamePolicy(name, resolved.namePolicy, resolved.source);
-  } catch (error) {
-    const correction = "repair or select a valid workspace policy before creating a branch";
-    return {
-      ok: false,
-      rule: "policy_unavailable",
-      source: "workspaces.json",
-      attempted: name,
-      correction,
-      error: `policy_unavailable: cannot validate branch ${JSON.stringify(name)} because ${error instanceof Error ? error.message : String(error)}; ${correction}`
-    };
-  }
-}, resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy, gitFlowOf = (root, integration) => {
-  try {
-    if (resolveBranchPolicyFor(root).preset !== "gitflow")
-      return null;
-    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
-    const names = branchNames(root);
-    const production = productionBranchOf(names);
-    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
-    return { develop, production, developExists: names.has(develop) };
-  } catch {
-    return null;
-  }
-}, releaseBranchesOf = (cwd) => {
-  try {
-    const resolved = resolveBranchPolicyFor(cwd);
-    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
-    return {
-      preset: resolved.preset,
-      branches: flow ? [flow.production, flow.develop] : [],
-      production: flow ? flow.production : resolved.defaultTargetBranch
-    };
-  } catch {
-    return { preset: "unknown", branches: [], production: null };
-  }
-}, releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase()), branchGuidance = (cwd) => {
-  try {
-    const patterns = branchPolicySnapshotFor(cwd).namePolicy.allowed;
-    const kinds = allowedKinds(patterns);
-    const kindShaped = new Set(kinds.map((kind) => branchGlobPattern(`${kind}/*`).source));
-    const anyName = patterns.some((pattern) => pattern.source === "^.*$");
-    const others = patterns.filter((pattern) => !kindShaped.has(pattern.source)).map((pattern) => globOf(pattern));
-    const allowed = anyName ? "Any non-protected branch name is allowed here." : `${kinds.length ? `Allowed branch kinds here: ${kindList(kinds)}${aliasNote(kinds)}` : "Allowed branch names here:"}${others.length ? `${kinds.length ? "; also" : ""} names matching ${others.join(", ")}` : ""}; anything else is denied.`;
-    const resolved = vcsConfig("resolve", cwd);
-    const integration = resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
-    const flow = resolved.releaseTrack?.track ? null : gitFlowOf(cwd, integration);
-    if (flow?.developExists)
-      return `${allowed} git-flow: feature/, bugfix/ and release/ start from origin/${flow.develop}, hotfix/ from origin/${flow.production}; feature/ and bugfix/ land on ${flow.develop}, release/ and hotfix/ on ${flow.production}.`;
-    const names = branchNames(cwd);
-    const configured = String(resolved.baseBranch ?? integration ?? "") || null;
-    const trunk = productionBranchOf(names);
-    const base = configured && names.has(configured) ? `Branch from origin/${configured}.` : names.has(trunk) ? `Branch from origin/${trunk}${configured ? ` (the default target ${configured} does not exist here)` : ""}.` : "No base branch exists here yet; pass the base explicitly.";
-    return `${allowed} ${base}`;
-  } catch {
-    return null;
-  }
-}, globOf = (pattern) => pattern.source.replace(/^\^|\$$/gu, "").replaceAll(".*", "*").replace(/\\(.)/gu, "$1");
-var init_branch = __esm(() => {
-  init_branch_policy();
-  init_commit_flavors();
-  init_git();
-  init_config();
-  init_workspaces();
-  init_vcs_config();
-  init_release_tracks();
-  KIND_SYNONYMS = {
-    fix: "bugfix",
-    fixes: "bugfix",
-    bug: "bugfix",
-    bugs: "bugfix",
-    bugfixes: "bugfix",
-    feat: "feature",
-    features: "feature",
-    chore: "feature",
-    docs: "feature",
-    doc: "feature",
-    refactor: "feature",
-    test: "feature",
-    tests: "feature",
-    ci: "feature",
-    build: "feature",
-    perf: "feature",
-    style: "feature",
-    deps: "feature",
-    task: "feature",
-    enhancement: "feature",
-    hot: "hotfix",
-    hotfixes: "hotfix",
-    releases: "release",
-    rel: "release"
-  };
-});
-
 // packages/workit-core/src/hooks/session-marker.ts
 import { createHash as createHash13 } from "node:crypto";
 import fs15 from "node:fs";
@@ -22221,9 +22255,14 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
-  const token = session ? recordIssuedSession(input.cwd || process.cwd(), session, own) : null;
-  const flags = token ? `--session ${own} --token ${token}` : `--session ${own}`;
-  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> ${flags} ...\` so the ledger tells it apart from the author.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
+  const cwd = input.cwd || process.cwd();
+  const token = session ? recordIssuedSession(cwd, session, own) : null;
+  if (session && !token)
+    return `${readOnly} ${own} was already issued to an earlier subagent, so no token is handed out again and a verdict under it would be refused (unbound_session). Record no verdict as ${own}: spawn a fresh verifier or reviewer, which gets its own session and token.`;
+  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
+  const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
+  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 }, failureDecision = (descriptor, event, error) => {
   if (event === "shell.pre" || event === "tool.pre" || event === "write.pre")
     return descriptor.shellPolicy.failClosed ? { kind: "deny", reason: error, unblock: null } : NONE5;