@brainervirus/workit-cursor 8.17.1 → 8.19.0

package/dist/workit-hook.js

@@ -8574,7 +8574,7 @@ function pushRemoteName(cwd, branch) {
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { createHash as createHash7, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash8, randomBytes as randomBytes2 } from "node:crypto";
 import fs6 from "node:fs";
 import path8 from "node:path";
 
@@ -10322,10 +10322,227 @@ function vcsConfig(mode, cwd, options = {}) {
 }
 
 // packages/workit-core/src/host-session.ts
-import { createHash as createHash6, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash as createHash7, randomBytes, timingSafeEqual } from "node:crypto";
 import fs5 from "node:fs";
 import path7 from "node:path";
 
+// packages/workit-core/src/core/branch.ts
+import { createHash as createHash6 } from "node:crypto";
+var withReleaseTracks = (workspaceRoot, policy) => {
+  const read = workspaceReleaseTracks(workspaceRoot);
+  if (read.error)
+    throw new ReleaseTrackError(read.error);
+  if (read.tracks.length === 0 && read.protectedBranches.length === 0)
+    return policy;
+  const known = new Set(policy.allowed.map((pattern) => pattern.source));
+  const allowed = [...policy.allowed];
+  for (const glob of read.tracks.flatMap((track) => Object.values(track.naming).map(namingGlob))) {
+    const pattern = branchGlobPattern(glob);
+    if (!known.has(pattern.source)) {
+      known.add(pattern.source);
+      allowed.push(pattern);
+    }
+  }
+  return {
+    ...policy,
+    allowed,
+    protected: new Set([
+      ...policy.protected,
+      ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
+    ])
+  };
+};
+function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
+  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
+  const config = readConfig();
+  return kind === "branch" ? {
+    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(workspaceRoot))),
+    provenance: { branchPolicy: selected.source }
+  } : {
+    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
+    provenance: { commitPolicy: selected.source }
+  };
+}
+var KIND_SYNONYMS = {
+  fix: "bugfix",
+  fixes: "bugfix",
+  bug: "bugfix",
+  bugs: "bugfix",
+  bugfixes: "bugfix",
+  feat: "feature",
+  features: "feature",
+  chore: "feature",
+  docs: "feature",
+  doc: "feature",
+  refactor: "feature",
+  test: "feature",
+  tests: "feature",
+  ci: "feature",
+  build: "feature",
+  perf: "feature",
+  style: "feature",
+  deps: "feature",
+  task: "feature",
+  enhancement: "feature",
+  hot: "hotfix",
+  hotfixes: "hotfix",
+  releases: "release",
+  rel: "release"
+};
+var allowedKinds = (allowed) => [
+  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
+];
+var editDistance = (a, b) => {
+  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (let i = 1;i <= a.length; i++) {
+    let previous = row[0];
+    row[0] = i;
+    for (let j = 1;j <= b.length; j++) {
+      const saved = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+      previous = saved;
+    }
+  }
+  return row[b.length];
+};
+var suggestBranchName = (name, kinds) => {
+  if (!kinds.length)
+    return null;
+  const slash = name.indexOf("/");
+  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
+  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
+  const synonym = KIND_SYNONYMS[prefix];
+  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
+  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
+  return `${kind}/${rest}`;
+};
+var kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", ");
+var aliasNote = (kinds) => {
+  const notes = [
+    ["fix", "bugfix"],
+    ["chore", "feature"]
+  ].filter(([, kind]) => kinds.includes(kind)).map(([alias, kind]) => `${alias}/ is ${kind}/`);
+  return notes.length ? ` (${notes.join(", ")})` : "";
+};
+var validateBranchNamePolicy = (name, policy, source) => {
+  const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
+  const kinds = allowedKinds(policy.allowed);
+  if (policy.protected.has(name.toLowerCase())) {
+    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
+    return {
+      ok: false,
+      rule: "protected_ref",
+      source,
+      attempted: name,
+      correction,
+      error: `protected_ref: branch ${JSON.stringify(name)} is protected by ${source}; ${correction}`
+    };
+  }
+  if (!policy.allowed.some((pattern) => pattern.test(name))) {
+    const suggestion = suggestBranchName(name, kinds);
+    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
+    return {
+      ok: false,
+      rule: "allowed_pattern",
+      source,
+      attempted: name,
+      correction,
+      error: `allowed_pattern: branch ${JSON.stringify(name)} violates ${source} policy; ${correction}`
+    };
+  }
+  return { ok: true };
+};
+var branchPolicySnapshotFor = (workspaceRoot) => {
+  const resolved = effectiveWorkspacePolicy(workspaceRoot, "branch");
+  const branchPolicy = resolved.branchPolicy;
+  const source = resolved.provenance.branchPolicy;
+  const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
+  const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
+  const fingerprint = createHash6("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
+  return {
+    branchPolicy,
+    namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
+    source,
+    fingerprint
+  };
+};
+var validateBranchNameFor = (workspaceRoot, name) => {
+  try {
+    const resolved = branchPolicySnapshotFor(workspaceRoot);
+    return validateBranchNamePolicy(name, resolved.namePolicy, resolved.source);
+  } catch (error) {
+    const correction = "repair or select a valid workspace policy before creating a branch";
+    return {
+      ok: false,
+      rule: "policy_unavailable",
+      source: "workspaces.json",
+      attempted: name,
+      correction,
+      error: `policy_unavailable: cannot validate branch ${JSON.stringify(name)} because ${error instanceof Error ? error.message : String(error)}; ${correction}`
+    };
+  }
+};
+var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
+var gitFlowOf = (root, integration) => {
+  try {
+    if (resolveBranchPolicyFor(root).preset !== "gitflow")
+      return null;
+    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    const names = branchNames(root);
+    const production = productionBranchOf(names);
+    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
+    return { develop, production, developExists: names.has(develop) };
+  } catch {
+    return null;
+  }
+};
+var releaseBranchesOf = (cwd) => {
+  try {
+    const resolved = resolveBranchPolicyFor(cwd);
+    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
+    return {
+      preset: resolved.preset,
+      branches: flow ? [flow.production, flow.develop] : [],
+      production: flow ? flow.production : resolved.defaultTargetBranch
+    };
+  } catch {
+    return { preset: "unknown", branches: [], production: null };
+  }
+};
+var releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase());
+var branchGuidance = (cwd) => {
+  try {
+    const patterns = branchPolicySnapshotFor(cwd).namePolicy.allowed;
+    const kinds = allowedKinds(patterns);
+    const kindShaped = new Set(kinds.map((kind) => branchGlobPattern(`${kind}/*`).source));
+    const anyName = patterns.some((pattern) => pattern.source === "^.*$");
+    const others = patterns.filter((pattern) => !kindShaped.has(pattern.source)).map((pattern) => globOf(pattern));
+    const allowed = anyName ? "Any non-protected branch name is allowed here." : `${kinds.length ? `Allowed branch kinds here: ${kindList(kinds)}${aliasNote(kinds)}` : "Allowed branch names here:"}${others.length ? `${kinds.length ? "; also" : ""} names matching ${others.join(", ")}` : ""}; anything else is denied.`;
+    const resolved = vcsConfig("resolve", cwd);
+    const integration = resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
+    const flow = resolved.releaseTrack?.track ? null : gitFlowOf(cwd, integration);
+    if (flow?.developExists)
+      return `${allowed} git-flow: feature/, bugfix/ and release/ start from origin/${flow.develop}, hotfix/ from origin/${flow.production}; feature/ and bugfix/ land on ${flow.develop}, release/ and hotfix/ on ${flow.production}.`;
+    const names = branchNames(cwd);
+    const configured = String(resolved.baseBranch ?? integration ?? "") || null;
+    const trunk = productionBranchOf(names);
+    const base = configured && names.has(configured) ? `Branch from origin/${configured}.` : names.has(trunk) ? `Branch from origin/${trunk}${configured ? ` (the default target ${configured} does not exist here)` : ""}.` : "No base branch exists here yet; pass the base explicitly.";
+    return `${allowed} ${base}`;
+  } catch {
+    return null;
+  }
+};
+var globOf = (pattern) => pattern.source.replace(/^\^|\$$/gu, "").replaceAll(".*", "*").replace(/\\(.)/gu, "$1");
+var policy = (root) => resolveBranchPolicyFor(root);
+var isProtected = (root, name) => policy(root).protected.has(name.toLowerCase());
+var isProtectedTarget = (root, name) => {
+  try {
+    return isProtected(root, name);
+  } catch {
+    return true;
+  }
+};
+
 // packages/workit-core/src/core/logger.ts
 import os3 from "node:os";
 import path6 from "node:path";
@@ -10415,7 +10632,7 @@ function hostSessionFromEnv(env) {
 }
 var ISSUED_PER_LEAD = 64;
 var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/3";
-var hash = (value) => createHash6("sha256").update(value).digest("hex").slice(0, 32);
+var hash = (value) => createHash7("sha256").update(value).digest("hex").slice(0, 32);
 var userIssuedRoot = () => path7.join(resolveStateDir(), "issued");
 var userTokenRoot = () => path7.join(resolveStateDir(), "issued-tokens");
 function migrateRepoIssued(cwd) {
@@ -10465,7 +10682,7 @@ var removeIfEmpty = (dir) => {
     fs5.rmdirSync(dir);
   } catch {}
 };
-var tokenHash = (token) => createHash6("sha256").update(token).digest("hex");
+var tokenHash = (token) => createHash7("sha256").update(token).digest("hex");
 function recordIssuedSession(cwd, lead, issued) {
   const token = randomBytes(18).toString("hex");
   try {
@@ -10485,6 +10702,21 @@ function recordIssuedSession(cwd, lead, issued) {
     return null;
   }
 }
+function judgeBranch(cwd) {
+  const branch = currentBranch(cwd);
+  return branch && !isProtectedTarget(cwd, branch) ? branch : null;
+}
+function verdictCommand(options) {
+  const kind = options.judge === "verifier" ? "<live|unit>" : options.judge === "reviewer" ? "review" : "<live|unit|review>";
+  return [
+    "workit ledger verdict <verified|failed|blocked>",
+    `--kind ${kind}`,
+    `--branch ${options.branch ?? "<branch>"}`,
+    options.session ? `--session ${options.session}` : null,
+    options.token ? `--token=${options.token}` : null,
+    '--how "<what you ran and saw>"'
+  ].filter(Boolean).join(" ");
+}
 function pruneIssued(dir, own, tokens) {
   try {
     const entries = fs5.readdirSync(dir);
@@ -10642,7 +10874,7 @@ function diffHash(cwd, base, head) {
   ], GIT_TIMEOUTS.worktree);
   if (!diff.ok || !diff.stdout)
     return null;
-  const hash = createHash7("sha256");
+  const hash = createHash8("sha256");
   for (const line of diff.stdout.split(`
 `)) {
     if (line.startsWith("index "))
@@ -10777,7 +11009,7 @@ function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
     ledgerLock.release(lock, token);
   }
 }
-var sha2562 = (text) => createHash7("sha256").update(text).digest("hex");
+var sha2562 = (text) => createHash8("sha256").update(text).digest("hex");
 var chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
 ${body}`);
 var TAIL_BYTES = 64 * 1024;
@@ -11528,7 +11760,7 @@ var productDecision = (task, ledger) => {
     };
   const since = Date.parse(task.createdAt);
   const branch = ledger.branch();
-  const row = ledger.rows().findLast((item) => item.type === "decision" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
+  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
   return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
     met: false,
     reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
@@ -12288,7 +12520,7 @@ var suggested = (kind) => kind === "merge" ? "verified" : "true";
 var grantHint = (workspace, kind) => `ask the user to run, in their own terminal: workit grant set ${workspace ?? "<workspace>"} ${kind}=${suggested(kind)}`;
 
 // packages/workit-core/src/core/task-store.ts
-import { createHash as createHash9, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash10, randomUUID as randomUUID3 } from "node:crypto";
 import * as fs11 from "node:fs";
 import path15 from "node:path";
 
@@ -13178,7 +13410,7 @@ var isPatch = (value) => Array.isArray(value) && value.every((op) => {
 });
 
 // packages/workit-core/src/store/reduce.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 var OPENING_TYPES = new Set([
   "task.opened",
   "task.imported",
@@ -13207,7 +13439,7 @@ var isObject5 = (value) => typeof value === "object" && value !== null && !Array
 var isKey = (value) => isObject5(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string");
 var BLOB_REF = "$blob";
 var blobRef = (value) => isObject5(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null;
-var blobDigest = (value) => createHash8("sha256").update(JSON.stringify(value)).digest("hex");
+var blobDigest = (value) => createHash9("sha256").update(JSON.stringify(value)).digest("hex");
 var toBlob = (value, blobs) => {
   if (!isObject5(value))
     return value;
@@ -14436,7 +14668,7 @@ class TaskStore {
     return bound.ok ? success(null, null, bound.data[0] ?? null) : bound;
   }
   withKeyLock(key, operation) {
-    const digest = createHash9("sha256").update(key).digest("hex").slice(0, 32);
+    const digest = createHash10("sha256").update(key).digest("hex").slice(0, 32);
     return this.withLock(path15.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
@@ -15061,7 +15293,7 @@ var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
 var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
 import path17 from "node:path";
@@ -15071,8 +15303,13 @@ import { spawnSync as spawnSync9 } from "node:child_process";
 import fs12 from "node:fs";
 import path16 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
-var CHECKS_FILE = "workit.checks.json";
-var checksConfigFile = (root) => path16.join(root, CHECKS_FILE);
+var CHECKS_FILE = ".workit/checks.json";
+var LEGACY_CHECKS_FILE = "workit.checks.json";
+function checksConfigFile(root) {
+  const current = path16.join(root, CHECKS_FILE);
+  const legacy = path16.join(root, LEGACY_CHECKS_FILE);
+  return !fs12.existsSync(current) && fs12.existsSync(legacy) ? legacy : current;
+}
 function repoHeavyCommands(root) {
   try {
     const value = JSON.parse(fs12.readFileSync(checksConfigFile(root), "utf8"));
@@ -15196,19 +15433,25 @@ var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = checksConfigFile(root);
+  const legacy = path16.basename(file) === LEGACY_CHECKS_FILE;
+  const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
+  const note = legacy ? {
+    note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
+  } : {};
   const none = (error = null) => ({
-    source: error ? CHECKS_FILE : "none",
+    source: error ? label : "none",
     root,
     checks: [],
     gates: {},
-    error
+    error,
+    ...note
   });
   let text = null;
   try {
     text = fs12.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
-      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+      return none(`cannot read ${label}: ${error.message}`);
   }
   if (text === null) {
     const checks = detectedChecks(root);
@@ -15218,33 +15461,33 @@ function loadCheckConfig(cwd) {
   try {
     parsed = JSON.parse(text);
   } catch {
-    return none(`${CHECKS_FILE} is not valid JSON`);
+    return none(`${label} is not valid JSON`);
   }
   if (!isRecord3(parsed) || !isRecord3(parsed.checks))
-    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+    return none(`${label} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
   const checks = [];
   for (const [name, value] of Object.entries(parsed.checks)) {
     if (!CHECK_NAME.test(name))
-      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+      return none(`${label}: check name "${name}" must match ${CHECK_NAME.source}`);
     const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
     if (argv instanceof Error)
-      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+      return none(`${label}: check "${name}": ${argv.message}`);
     checks.push({ name, argv, accepts: [argv] });
   }
   const gates = {};
   if (parsed.gates !== undefined) {
     if (!isRecord3(parsed.gates))
-      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+      return none(`${label}: gates must be {"testing":"<name>"|["<name>",…]}`);
     for (const [gate, value] of Object.entries(parsed.gates)) {
       if (!GATES.includes(gate))
-        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+        return none(`${label}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
       const names = typeof value === "string" ? [value] : value;
       if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
-        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+        return none(`${label}: gates.${gate} must name configured checks`);
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
+  return { source: label, root, checks, gates, error: null, ...note, resources: parsed.resources };
 }
 var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
 function matchesNamedCheck(config, name, argv, cwd) {
@@ -15283,7 +15526,7 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes = (value) => createHash10("sha256").update(value).digest("hex");
+var digestBytes = (value) => createHash11("sha256").update(value).digest("hex");
 var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`);
 var relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".";
 var canonicalPath = (value) => {
@@ -15711,7 +15954,7 @@ function evaluateObservedGate(task, requirement, statuses, config) {
     return {
       satisfied: [],
       considered,
-      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE}, e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
     };
   const satisfied = fresh.filter(named);
   if (satisfied.length)
@@ -17932,7 +18175,7 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import fs14 from "node:fs";
 import path18 from "node:path";
 var MIGRATION_PENDING_NOTE = "workit migration pending — run `workit task status`";
@@ -18088,7 +18331,7 @@ var turnContextText = (input, descriptor) => {
   }
 };
 var TURN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
-var digestOf = (text) => createHash11("sha256").update(text).digest("hex");
+var digestOf = (text) => createHash12("sha256").update(text).digest("hex");
 var turnMarker = (input) => {
   if (!input.session.id)
     return null;
@@ -18167,214 +18410,6 @@ import fs16 from "node:fs";
 import os5 from "node:os";
 import path20 from "node:path";
 
-// packages/workit-core/src/core/branch.ts
-import { createHash as createHash12 } from "node:crypto";
-var withReleaseTracks = (workspaceRoot, policy) => {
-  const read = workspaceReleaseTracks(workspaceRoot);
-  if (read.error)
-    throw new ReleaseTrackError(read.error);
-  if (read.tracks.length === 0 && read.protectedBranches.length === 0)
-    return policy;
-  const known = new Set(policy.allowed.map((pattern) => pattern.source));
-  const allowed = [...policy.allowed];
-  for (const glob of read.tracks.flatMap((track) => Object.values(track.naming).map(namingGlob))) {
-    const pattern = branchGlobPattern(glob);
-    if (!known.has(pattern.source)) {
-      known.add(pattern.source);
-      allowed.push(pattern);
-    }
-  }
-  return {
-    ...policy,
-    allowed,
-    protected: new Set([
-      ...policy.protected,
-      ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
-    ])
-  };
-};
-function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
-  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
-  const config = readConfig();
-  return kind === "branch" ? {
-    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(workspaceRoot))),
-    provenance: { branchPolicy: selected.source }
-  } : {
-    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
-    provenance: { commitPolicy: selected.source }
-  };
-}
-var KIND_SYNONYMS = {
-  fix: "bugfix",
-  fixes: "bugfix",
-  bug: "bugfix",
-  bugs: "bugfix",
-  bugfixes: "bugfix",
-  feat: "feature",
-  features: "feature",
-  chore: "feature",
-  docs: "feature",
-  doc: "feature",
-  refactor: "feature",
-  test: "feature",
-  tests: "feature",
-  ci: "feature",
-  build: "feature",
-  perf: "feature",
-  style: "feature",
-  deps: "feature",
-  task: "feature",
-  enhancement: "feature",
-  hot: "hotfix",
-  hotfixes: "hotfix",
-  releases: "release",
-  rel: "release"
-};
-var allowedKinds = (allowed) => [
-  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
-];
-var editDistance = (a, b) => {
-  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
-  for (let i = 1;i <= a.length; i++) {
-    let previous = row[0];
-    row[0] = i;
-    for (let j = 1;j <= b.length; j++) {
-      const saved = row[j];
-      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
-      previous = saved;
-    }
-  }
-  return row[b.length];
-};
-var suggestBranchName = (name, kinds) => {
-  if (!kinds.length)
-    return null;
-  const slash = name.indexOf("/");
-  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
-  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
-  const synonym = KIND_SYNONYMS[prefix];
-  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
-  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
-  return `${kind}/${rest}`;
-};
-var kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", ");
-var aliasNote = (kinds) => {
-  const notes = [
-    ["fix", "bugfix"],
-    ["chore", "feature"]
-  ].filter(([, kind]) => kinds.includes(kind)).map(([alias, kind]) => `${alias}/ is ${kind}/`);
-  return notes.length ? ` (${notes.join(", ")})` : "";
-};
-var validateBranchNamePolicy = (name, policy, source) => {
-  const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
-  const kinds = allowedKinds(policy.allowed);
-  if (policy.protected.has(name.toLowerCase())) {
-    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
-    return {
-      ok: false,
-      rule: "protected_ref",
-      source,
-      attempted: name,
-      correction,
-      error: `protected_ref: branch ${JSON.stringify(name)} is protected by ${source}; ${correction}`
-    };
-  }
-  if (!policy.allowed.some((pattern) => pattern.test(name))) {
-    const suggestion = suggestBranchName(name, kinds);
-    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
-    return {
-      ok: false,
-      rule: "allowed_pattern",
-      source,
-      attempted: name,
-      correction,
-      error: `allowed_pattern: branch ${JSON.stringify(name)} violates ${source} policy; ${correction}`
-    };
-  }
-  return { ok: true };
-};
-var branchPolicySnapshotFor = (workspaceRoot) => {
-  const resolved = effectiveWorkspacePolicy(workspaceRoot, "branch");
-  const branchPolicy = resolved.branchPolicy;
-  const source = resolved.provenance.branchPolicy;
-  const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
-  const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
-  const fingerprint = createHash12("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
-  return {
-    branchPolicy,
-    namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
-    source,
-    fingerprint
-  };
-};
-var validateBranchNameFor = (workspaceRoot, name) => {
-  try {
-    const resolved = branchPolicySnapshotFor(workspaceRoot);
-    return validateBranchNamePolicy(name, resolved.namePolicy, resolved.source);
-  } catch (error) {
-    const correction = "repair or select a valid workspace policy before creating a branch";
-    return {
-      ok: false,
-      rule: "policy_unavailable",
-      source: "workspaces.json",
-      attempted: name,
-      correction,
-      error: `policy_unavailable: cannot validate branch ${JSON.stringify(name)} because ${error instanceof Error ? error.message : String(error)}; ${correction}`
-    };
-  }
-};
-var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
-var gitFlowOf = (root, integration) => {
-  try {
-    if (resolveBranchPolicyFor(root).preset !== "gitflow")
-      return null;
-    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
-    const names = branchNames(root);
-    const production = productionBranchOf(names);
-    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
-    return { develop, production, developExists: names.has(develop) };
-  } catch {
-    return null;
-  }
-};
-var releaseBranchesOf = (cwd) => {
-  try {
-    const resolved = resolveBranchPolicyFor(cwd);
-    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
-    return {
-      preset: resolved.preset,
-      branches: flow ? [flow.production, flow.develop] : [],
-      production: flow ? flow.production : resolved.defaultTargetBranch
-    };
-  } catch {
-    return { preset: "unknown", branches: [], production: null };
-  }
-};
-var releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase());
-var branchGuidance = (cwd) => {
-  try {
-    const patterns = branchPolicySnapshotFor(cwd).namePolicy.allowed;
-    const kinds = allowedKinds(patterns);
-    const kindShaped = new Set(kinds.map((kind) => branchGlobPattern(`${kind}/*`).source));
-    const anyName = patterns.some((pattern) => pattern.source === "^.*$");
-    const others = patterns.filter((pattern) => !kindShaped.has(pattern.source)).map((pattern) => globOf(pattern));
-    const allowed = anyName ? "Any non-protected branch name is allowed here." : `${kinds.length ? `Allowed branch kinds here: ${kindList(kinds)}${aliasNote(kinds)}` : "Allowed branch names here:"}${others.length ? `${kinds.length ? "; also" : ""} names matching ${others.join(", ")}` : ""}; anything else is denied.`;
-    const resolved = vcsConfig("resolve", cwd);
-    const integration = resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
-    const flow = resolved.releaseTrack?.track ? null : gitFlowOf(cwd, integration);
-    if (flow?.developExists)
-      return `${allowed} git-flow: feature/, bugfix/ and release/ start from origin/${flow.develop}, hotfix/ from origin/${flow.production}; feature/ and bugfix/ land on ${flow.develop}, release/ and hotfix/ on ${flow.production}.`;
-    const names = branchNames(cwd);
-    const configured = String(resolved.baseBranch ?? integration ?? "") || null;
-    const trunk = productionBranchOf(names);
-    const base = configured && names.has(configured) ? `Branch from origin/${configured}.` : names.has(trunk) ? `Branch from origin/${trunk}${configured ? ` (the default target ${configured} does not exist here)` : ""}.` : "No base branch exists here yet; pass the base explicitly.";
-    return `${allowed} ${base}`;
-  } catch {
-    return null;
-  }
-};
-var globOf = (pattern) => pattern.source.replace(/^\^|\$$/gu, "").replaceAll(".*", "*").replace(/\\(.)/gu, "$1");
-
 // packages/workit-core/src/hooks/session-marker.ts
 import { createHash as createHash13 } from "node:crypto";
 import fs15 from "node:fs";
@@ -22368,9 +22403,14 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
-  const token = session ? recordIssuedSession(input.cwd || process.cwd(), session, own) : null;
-  const flags = token ? `--session ${own} --token ${token}` : `--session ${own}`;
-  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> ${flags} ...\` so the ledger tells it apart from the author.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
+  const cwd = input.cwd || process.cwd();
+  const token = session ? recordIssuedSession(cwd, session, own) : null;
+  if (session && !token)
+    return `${readOnly} ${own} was already issued to an earlier subagent, so no token is handed out again and a verdict under it would be refused (unbound_session). Record no verdict as ${own}: spawn a fresh verifier or reviewer, which gets its own session and token.`;
+  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
+  const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
+  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 function handleHook(input, deps) {
   const { descriptor } = deps;