@brainervirus/workit-cursor 8.18.0 → 8.19.1

package/dist/workit-hook.js

@@ -8574,7 +8574,7 @@ function pushRemoteName(cwd, branch) {
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { createHash as createHash7, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash8, randomBytes as randomBytes2 } from "node:crypto";
 import fs6 from "node:fs";
 import path8 from "node:path";
 
@@ -10322,10 +10322,227 @@ function vcsConfig(mode, cwd, options = {}) {
 }
 
 // packages/workit-core/src/host-session.ts
-import { createHash as createHash6, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash as createHash7, randomBytes, timingSafeEqual } from "node:crypto";
 import fs5 from "node:fs";
 import path7 from "node:path";
 
+// packages/workit-core/src/core/branch.ts
+import { createHash as createHash6 } from "node:crypto";
+var withReleaseTracks = (workspaceRoot, policy) => {
+  const read = workspaceReleaseTracks(workspaceRoot);
+  if (read.error)
+    throw new ReleaseTrackError(read.error);
+  if (read.tracks.length === 0 && read.protectedBranches.length === 0)
+    return policy;
+  const known = new Set(policy.allowed.map((pattern) => pattern.source));
+  const allowed = [...policy.allowed];
+  for (const glob of read.tracks.flatMap((track) => Object.values(track.naming).map(namingGlob))) {
+    const pattern = branchGlobPattern(glob);
+    if (!known.has(pattern.source)) {
+      known.add(pattern.source);
+      allowed.push(pattern);
+    }
+  }
+  return {
+    ...policy,
+    allowed,
+    protected: new Set([
+      ...policy.protected,
+      ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
+    ])
+  };
+};
+function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
+  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
+  const config = readConfig();
+  return kind === "branch" ? {
+    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(workspaceRoot))),
+    provenance: { branchPolicy: selected.source }
+  } : {
+    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
+    provenance: { commitPolicy: selected.source }
+  };
+}
+var KIND_SYNONYMS = {
+  fix: "bugfix",
+  fixes: "bugfix",
+  bug: "bugfix",
+  bugs: "bugfix",
+  bugfixes: "bugfix",
+  feat: "feature",
+  features: "feature",
+  chore: "feature",
+  docs: "feature",
+  doc: "feature",
+  refactor: "feature",
+  test: "feature",
+  tests: "feature",
+  ci: "feature",
+  build: "feature",
+  perf: "feature",
+  style: "feature",
+  deps: "feature",
+  task: "feature",
+  enhancement: "feature",
+  hot: "hotfix",
+  hotfixes: "hotfix",
+  releases: "release",
+  rel: "release"
+};
+var allowedKinds = (allowed) => [
+  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
+];
+var editDistance = (a, b) => {
+  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (let i = 1;i <= a.length; i++) {
+    let previous = row[0];
+    row[0] = i;
+    for (let j = 1;j <= b.length; j++) {
+      const saved = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+      previous = saved;
+    }
+  }
+  return row[b.length];
+};
+var suggestBranchName = (name, kinds) => {
+  if (!kinds.length)
+    return null;
+  const slash = name.indexOf("/");
+  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
+  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
+  const synonym = KIND_SYNONYMS[prefix];
+  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
+  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
+  return `${kind}/${rest}`;
+};
+var kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", ");
+var aliasNote = (kinds) => {
+  const notes = [
+    ["fix", "bugfix"],
+    ["chore", "feature"]
+  ].filter(([, kind]) => kinds.includes(kind)).map(([alias, kind]) => `${alias}/ is ${kind}/`);
+  return notes.length ? ` (${notes.join(", ")})` : "";
+};
+var validateBranchNamePolicy = (name, policy, source) => {
+  const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
+  const kinds = allowedKinds(policy.allowed);
+  if (policy.protected.has(name.toLowerCase())) {
+    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
+    return {
+      ok: false,
+      rule: "protected_ref",
+      source,
+      attempted: name,
+      correction,
+      error: `protected_ref: branch ${JSON.stringify(name)} is protected by ${source}; ${correction}`
+    };
+  }
+  if (!policy.allowed.some((pattern) => pattern.test(name))) {
+    const suggestion = suggestBranchName(name, kinds);
+    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
+    return {
+      ok: false,
+      rule: "allowed_pattern",
+      source,
+      attempted: name,
+      correction,
+      error: `allowed_pattern: branch ${JSON.stringify(name)} violates ${source} policy; ${correction}`
+    };
+  }
+  return { ok: true };
+};
+var branchPolicySnapshotFor = (workspaceRoot) => {
+  const resolved = effectiveWorkspacePolicy(workspaceRoot, "branch");
+  const branchPolicy = resolved.branchPolicy;
+  const source = resolved.provenance.branchPolicy;
+  const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
+  const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
+  const fingerprint = createHash6("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
+  return {
+    branchPolicy,
+    namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
+    source,
+    fingerprint
+  };
+};
+var validateBranchNameFor = (workspaceRoot, name) => {
+  try {
+    const resolved = branchPolicySnapshotFor(workspaceRoot);
+    return validateBranchNamePolicy(name, resolved.namePolicy, resolved.source);
+  } catch (error) {
+    const correction = "repair or select a valid workspace policy before creating a branch";
+    return {
+      ok: false,
+      rule: "policy_unavailable",
+      source: "workspaces.json",
+      attempted: name,
+      correction,
+      error: `policy_unavailable: cannot validate branch ${JSON.stringify(name)} because ${error instanceof Error ? error.message : String(error)}; ${correction}`
+    };
+  }
+};
+var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
+var gitFlowOf = (root, integration) => {
+  try {
+    if (resolveBranchPolicyFor(root).preset !== "gitflow")
+      return null;
+    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    const names = branchNames(root);
+    const production = productionBranchOf(names);
+    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
+    return { develop, production, developExists: names.has(develop) };
+  } catch {
+    return null;
+  }
+};
+var releaseBranchesOf = (cwd) => {
+  try {
+    const resolved = resolveBranchPolicyFor(cwd);
+    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
+    return {
+      preset: resolved.preset,
+      branches: flow ? [flow.production, flow.develop] : [],
+      production: flow ? flow.production : resolved.defaultTargetBranch
+    };
+  } catch {
+    return { preset: "unknown", branches: [], production: null };
+  }
+};
+var releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase());
+var branchGuidance = (cwd) => {
+  try {
+    const patterns = branchPolicySnapshotFor(cwd).namePolicy.allowed;
+    const kinds = allowedKinds(patterns);
+    const kindShaped = new Set(kinds.map((kind) => branchGlobPattern(`${kind}/*`).source));
+    const anyName = patterns.some((pattern) => pattern.source === "^.*$");
+    const others = patterns.filter((pattern) => !kindShaped.has(pattern.source)).map((pattern) => globOf(pattern));
+    const allowed = anyName ? "Any non-protected branch name is allowed here." : `${kinds.length ? `Allowed branch kinds here: ${kindList(kinds)}${aliasNote(kinds)}` : "Allowed branch names here:"}${others.length ? `${kinds.length ? "; also" : ""} names matching ${others.join(", ")}` : ""}; anything else is denied.`;
+    const resolved = vcsConfig("resolve", cwd);
+    const integration = resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
+    const flow = resolved.releaseTrack?.track ? null : gitFlowOf(cwd, integration);
+    if (flow?.developExists)
+      return `${allowed} git-flow: feature/, bugfix/ and release/ start from origin/${flow.develop}, hotfix/ from origin/${flow.production}; feature/ and bugfix/ land on ${flow.develop}, release/ and hotfix/ on ${flow.production}.`;
+    const names = branchNames(cwd);
+    const configured = String(resolved.baseBranch ?? integration ?? "") || null;
+    const trunk = productionBranchOf(names);
+    const base = configured && names.has(configured) ? `Branch from origin/${configured}.` : names.has(trunk) ? `Branch from origin/${trunk}${configured ? ` (the default target ${configured} does not exist here)` : ""}.` : "No base branch exists here yet; pass the base explicitly.";
+    return `${allowed} ${base}`;
+  } catch {
+    return null;
+  }
+};
+var globOf = (pattern) => pattern.source.replace(/^\^|\$$/gu, "").replaceAll(".*", "*").replace(/\\(.)/gu, "$1");
+var policy = (root) => resolveBranchPolicyFor(root);
+var isProtected = (root, name) => policy(root).protected.has(name.toLowerCase());
+var isProtectedTarget = (root, name) => {
+  try {
+    return isProtected(root, name);
+  } catch {
+    return true;
+  }
+};
+
 // packages/workit-core/src/core/logger.ts
 import os3 from "node:os";
 import path6 from "node:path";
@@ -10415,7 +10632,7 @@ function hostSessionFromEnv(env) {
 }
 var ISSUED_PER_LEAD = 64;
 var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/3";
-var hash = (value) => createHash6("sha256").update(value).digest("hex").slice(0, 32);
+var hash = (value) => createHash7("sha256").update(value).digest("hex").slice(0, 32);
 var userIssuedRoot = () => path7.join(resolveStateDir(), "issued");
 var userTokenRoot = () => path7.join(resolveStateDir(), "issued-tokens");
 function migrateRepoIssued(cwd) {
@@ -10465,7 +10682,7 @@ var removeIfEmpty = (dir) => {
     fs5.rmdirSync(dir);
   } catch {}
 };
-var tokenHash = (token) => createHash6("sha256").update(token).digest("hex");
+var tokenHash = (token) => createHash7("sha256").update(token).digest("hex");
 function recordIssuedSession(cwd, lead, issued) {
   const token = randomBytes(18).toString("hex");
   try {
@@ -10485,6 +10702,21 @@ function recordIssuedSession(cwd, lead, issued) {
     return null;
   }
 }
+function judgeBranch(cwd) {
+  const branch = currentBranch(cwd);
+  return branch && !isProtectedTarget(cwd, branch) ? branch : null;
+}
+function verdictCommand(options) {
+  const kind = options.judge === "verifier" ? "<live|unit>" : options.judge === "reviewer" ? "review" : "<live|unit|review>";
+  return [
+    "workit ledger verdict <verified|failed|blocked>",
+    `--kind ${kind}`,
+    `--branch ${options.branch ?? "<branch>"}`,
+    options.session ? `--session ${options.session}` : null,
+    options.token ? `--token=${options.token}` : null,
+    '--how "<what you ran and saw>"'
+  ].filter(Boolean).join(" ");
+}
 function pruneIssued(dir, own, tokens) {
   try {
     const entries = fs5.readdirSync(dir);
@@ -10642,7 +10874,7 @@ function diffHash(cwd, base, head) {
   ], GIT_TIMEOUTS.worktree);
   if (!diff.ok || !diff.stdout)
     return null;
-  const hash = createHash7("sha256");
+  const hash = createHash8("sha256");
   for (const line of diff.stdout.split(`
 `)) {
     if (line.startsWith("index "))
@@ -10777,7 +11009,7 @@ function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
     ledgerLock.release(lock, token);
   }
 }
-var sha2562 = (text) => createHash7("sha256").update(text).digest("hex");
+var sha2562 = (text) => createHash8("sha256").update(text).digest("hex");
 var chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
 ${body}`);
 var TAIL_BYTES = 64 * 1024;
@@ -12288,7 +12520,7 @@ var suggested = (kind) => kind === "merge" ? "verified" : "true";
 var grantHint = (workspace, kind) => `ask the user to run, in their own terminal: workit grant set ${workspace ?? "<workspace>"} ${kind}=${suggested(kind)}`;
 
 // packages/workit-core/src/core/task-store.ts
-import { createHash as createHash9, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash10, randomUUID as randomUUID3 } from "node:crypto";
 import * as fs11 from "node:fs";
 import path15 from "node:path";
 
@@ -13178,7 +13410,7 @@ var isPatch = (value) => Array.isArray(value) && value.every((op) => {
 });
 
 // packages/workit-core/src/store/reduce.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 var OPENING_TYPES = new Set([
   "task.opened",
   "task.imported",
@@ -13207,7 +13439,7 @@ var isObject5 = (value) => typeof value === "object" && value !== null && !Array
 var isKey = (value) => isObject5(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string");
 var BLOB_REF = "$blob";
 var blobRef = (value) => isObject5(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null;
-var blobDigest = (value) => createHash8("sha256").update(JSON.stringify(value)).digest("hex");
+var blobDigest = (value) => createHash9("sha256").update(JSON.stringify(value)).digest("hex");
 var toBlob = (value, blobs) => {
   if (!isObject5(value))
     return value;
@@ -14436,7 +14668,7 @@ class TaskStore {
     return bound.ok ? success(null, null, bound.data[0] ?? null) : bound;
   }
   withKeyLock(key, operation) {
-    const digest = createHash9("sha256").update(key).digest("hex").slice(0, 32);
+    const digest = createHash10("sha256").update(key).digest("hex").slice(0, 32);
     return this.withLock(path15.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
@@ -15061,7 +15293,7 @@ var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
 var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
 import path17 from "node:path";
@@ -15294,7 +15526,7 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes = (value) => createHash10("sha256").update(value).digest("hex");
+var digestBytes = (value) => createHash11("sha256").update(value).digest("hex");
 var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`);
 var relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".";
 var canonicalPath = (value) => {
@@ -17943,7 +18175,7 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import fs14 from "node:fs";
 import path18 from "node:path";
 var MIGRATION_PENDING_NOTE = "workit migration pending — run `workit task status`";
@@ -18099,7 +18331,7 @@ var turnContextText = (input, descriptor) => {
   }
 };
 var TURN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
-var digestOf = (text) => createHash11("sha256").update(text).digest("hex");
+var digestOf = (text) => createHash12("sha256").update(text).digest("hex");
 var turnMarker = (input) => {
   if (!input.session.id)
     return null;
@@ -18178,214 +18410,6 @@ import fs16 from "node:fs";
 import os5 from "node:os";
 import path20 from "node:path";
 
-// packages/workit-core/src/core/branch.ts
-import { createHash as createHash12 } from "node:crypto";
-var withReleaseTracks = (workspaceRoot, policy) => {
-  const read = workspaceReleaseTracks(workspaceRoot);
-  if (read.error)
-    throw new ReleaseTrackError(read.error);
-  if (read.tracks.length === 0 && read.protectedBranches.length === 0)
-    return policy;
-  const known = new Set(policy.allowed.map((pattern) => pattern.source));
-  const allowed = [...policy.allowed];
-  for (const glob of read.tracks.flatMap((track) => Object.values(track.naming).map(namingGlob))) {
-    const pattern = branchGlobPattern(glob);
-    if (!known.has(pattern.source)) {
-      known.add(pattern.source);
-      allowed.push(pattern);
-    }
-  }
-  return {
-    ...policy,
-    allowed,
-    protected: new Set([
-      ...policy.protected,
-      ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
-    ])
-  };
-};
-function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
-  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
-  const config = readConfig();
-  return kind === "branch" ? {
-    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(workspaceRoot))),
-    provenance: { branchPolicy: selected.source }
-  } : {
-    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
-    provenance: { commitPolicy: selected.source }
-  };
-}
-var KIND_SYNONYMS = {
-  fix: "bugfix",
-  fixes: "bugfix",
-  bug: "bugfix",
-  bugs: "bugfix",
-  bugfixes: "bugfix",
-  feat: "feature",
-  features: "feature",
-  chore: "feature",
-  docs: "feature",
-  doc: "feature",
-  refactor: "feature",
-  test: "feature",
-  tests: "feature",
-  ci: "feature",
-  build: "feature",
-  perf: "feature",
-  style: "feature",
-  deps: "feature",
-  task: "feature",
-  enhancement: "feature",
-  hot: "hotfix",
-  hotfixes: "hotfix",
-  releases: "release",
-  rel: "release"
-};
-var allowedKinds = (allowed) => [
-  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
-];
-var editDistance = (a, b) => {
-  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
-  for (let i = 1;i <= a.length; i++) {
-    let previous = row[0];
-    row[0] = i;
-    for (let j = 1;j <= b.length; j++) {
-      const saved = row[j];
-      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
-      previous = saved;
-    }
-  }
-  return row[b.length];
-};
-var suggestBranchName = (name, kinds) => {
-  if (!kinds.length)
-    return null;
-  const slash = name.indexOf("/");
-  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
-  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
-  const synonym = KIND_SYNONYMS[prefix];
-  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
-  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
-  return `${kind}/${rest}`;
-};
-var kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", ");
-var aliasNote = (kinds) => {
-  const notes = [
-    ["fix", "bugfix"],
-    ["chore", "feature"]
-  ].filter(([, kind]) => kinds.includes(kind)).map(([alias, kind]) => `${alias}/ is ${kind}/`);
-  return notes.length ? ` (${notes.join(", ")})` : "";
-};
-var validateBranchNamePolicy = (name, policy, source) => {
-  const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
-  const kinds = allowedKinds(policy.allowed);
-  if (policy.protected.has(name.toLowerCase())) {
-    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
-    return {
-      ok: false,
-      rule: "protected_ref",
-      source,
-      attempted: name,
-      correction,
-      error: `protected_ref: branch ${JSON.stringify(name)} is protected by ${source}; ${correction}`
-    };
-  }
-  if (!policy.allowed.some((pattern) => pattern.test(name))) {
-    const suggestion = suggestBranchName(name, kinds);
-    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
-    return {
-      ok: false,
-      rule: "allowed_pattern",
-      source,
-      attempted: name,
-      correction,
-      error: `allowed_pattern: branch ${JSON.stringify(name)} violates ${source} policy; ${correction}`
-    };
-  }
-  return { ok: true };
-};
-var branchPolicySnapshotFor = (workspaceRoot) => {
-  const resolved = effectiveWorkspacePolicy(workspaceRoot, "branch");
-  const branchPolicy = resolved.branchPolicy;
-  const source = resolved.provenance.branchPolicy;
-  const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
-  const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
-  const fingerprint = createHash12("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
-  return {
-    branchPolicy,
-    namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
-    source,
-    fingerprint
-  };
-};
-var validateBranchNameFor = (workspaceRoot, name) => {
-  try {
-    const resolved = branchPolicySnapshotFor(workspaceRoot);
-    return validateBranchNamePolicy(name, resolved.namePolicy, resolved.source);
-  } catch (error) {
-    const correction = "repair or select a valid workspace policy before creating a branch";
-    return {
-      ok: false,
-      rule: "policy_unavailable",
-      source: "workspaces.json",
-      attempted: name,
-      correction,
-      error: `policy_unavailable: cannot validate branch ${JSON.stringify(name)} because ${error instanceof Error ? error.message : String(error)}; ${correction}`
-    };
-  }
-};
-var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
-var gitFlowOf = (root, integration) => {
-  try {
-    if (resolveBranchPolicyFor(root).preset !== "gitflow")
-      return null;
-    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
-    const names = branchNames(root);
-    const production = productionBranchOf(names);
-    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
-    return { develop, production, developExists: names.has(develop) };
-  } catch {
-    return null;
-  }
-};
-var releaseBranchesOf = (cwd) => {
-  try {
-    const resolved = resolveBranchPolicyFor(cwd);
-    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
-    return {
-      preset: resolved.preset,
-      branches: flow ? [flow.production, flow.develop] : [],
-      production: flow ? flow.production : resolved.defaultTargetBranch
-    };
-  } catch {
-    return { preset: "unknown", branches: [], production: null };
-  }
-};
-var releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase());
-var branchGuidance = (cwd) => {
-  try {
-    const patterns = branchPolicySnapshotFor(cwd).namePolicy.allowed;
-    const kinds = allowedKinds(patterns);
-    const kindShaped = new Set(kinds.map((kind) => branchGlobPattern(`${kind}/*`).source));
-    const anyName = patterns.some((pattern) => pattern.source === "^.*$");
-    const others = patterns.filter((pattern) => !kindShaped.has(pattern.source)).map((pattern) => globOf(pattern));
-    const allowed = anyName ? "Any non-protected branch name is allowed here." : `${kinds.length ? `Allowed branch kinds here: ${kindList(kinds)}${aliasNote(kinds)}` : "Allowed branch names here:"}${others.length ? `${kinds.length ? "; also" : ""} names matching ${others.join(", ")}` : ""}; anything else is denied.`;
-    const resolved = vcsConfig("resolve", cwd);
-    const integration = resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
-    const flow = resolved.releaseTrack?.track ? null : gitFlowOf(cwd, integration);
-    if (flow?.developExists)
-      return `${allowed} git-flow: feature/, bugfix/ and release/ start from origin/${flow.develop}, hotfix/ from origin/${flow.production}; feature/ and bugfix/ land on ${flow.develop}, release/ and hotfix/ on ${flow.production}.`;
-    const names = branchNames(cwd);
-    const configured = String(resolved.baseBranch ?? integration ?? "") || null;
-    const trunk = productionBranchOf(names);
-    const base = configured && names.has(configured) ? `Branch from origin/${configured}.` : names.has(trunk) ? `Branch from origin/${trunk}${configured ? ` (the default target ${configured} does not exist here)` : ""}.` : "No base branch exists here yet; pass the base explicitly.";
-    return `${allowed} ${base}`;
-  } catch {
-    return null;
-  }
-};
-var globOf = (pattern) => pattern.source.replace(/^\^|\$$/gu, "").replaceAll(".*", "*").replace(/\\(.)/gu, "$1");
-
 // packages/workit-core/src/hooks/session-marker.ts
 import { createHash as createHash13 } from "node:crypto";
 import fs15 from "node:fs";
@@ -22379,9 +22403,14 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
-  const token = session ? recordIssuedSession(input.cwd || process.cwd(), session, own) : null;
-  const flags = token ? `--session ${own} --token ${token}` : `--session ${own}`;
-  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> ${flags} ...\` so the ledger tells it apart from the author.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
+  const cwd = input.cwd || process.cwd();
+  const token = session ? recordIssuedSession(cwd, session, own) : null;
+  if (session && !token)
+    return `${readOnly} ${own} was already issued to an earlier subagent, so no token is handed out again and a verdict under it would be refused (unbound_session). Record no verdict as ${own}: spawn a fresh verifier or reviewer, which gets its own session and token.`;
+  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
+  const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
+  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 function handleHook(input, deps) {
   const { descriptor } = deps;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "8.18.0",
+  "version": "8.19.1",
   "private": false,
   "description": "Workit Cursor plugin — shared MCP transport, native hooks, and sixteen method skills",
   "keywords": [
@@ -46,8 +46,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.18.0",
-    "@brainervirus/workit-mcp": "^8.18.0"
+    "@brainervirus/workit-core": "^8.19.1",
+    "@brainervirus/workit-mcp": "^8.19.1"
   },
   "engines": {
     "node": ">=24"

package/skills/workit-implement/SKILL.md

@@ -24,7 +24,10 @@ description: Build a requested change in small verified steps - follow local pat
    lease waits and names its holder (`workit lock status`).
 5. Prove the feature on its real surface with the project's `verify-<app>`
    skill; none yet? Write one (read the `workit-verify-app` skill's SKILL.md and follow it). Tests show branch behavior,
-   not that the feature works.
+   not that the feature works. The report carries what you observed: a UI
+   change a screenshot or console/network check (chrome devtools or
+   agent-browser), an API a quoted real response. App not runnable? Say so
+   plainly, never claim success.
 6. Commit: `workit git commit -m "<type>: <what>" -- <paths>` (or `--all`).
    No endpoint named? Stop here and state the next command. Hand delivery to
    ship, which pushes and opens the PR with its body shape (read the `workit-ship` skill's SKILL.md and follow it), only
@@ -55,8 +58,7 @@ flag was never invoked)
 
 Good: "Added `--since`. measured: `workit check test` exit 0;
 `mytool log --since 2d` printed 3 entries against the fixture repo. inferred:
-the GitLab path behaves the same (shared parser, not run). Verification handed
-to the verifier agent."
+the GitLab path behaves the same (not run). Handed to the verifier agent."
 
 ## Check
 

package/skills/workit-verify-app/SKILL.md

@@ -27,7 +27,10 @@ way a user would.
    - **Drive:** how to exercise it: CLI invocations, `curl` against routes, a
      browser tool for UI, with fixture data.
    - **Evidence:** what to capture (exit code, response body, screenshot path)
-     and the command that records it.
+     and the command that records it. A UI is driven with chrome devtools or
+     agent-browser, with a screenshot or console/network observation; an API
+     with a real call, response quoted. The report carries the observation.
+     App not runnable? Say so plainly, never claim success.
    - **Cleanup:** stop processes, remove temp data.
    - **Feature map:** feature, how to drive it, expected observation.
 3. **Prove it end-to-end once:** launch, drive one feature, capture evidence,
@@ -54,7 +57,8 @@ report `clean`, `changed` (what) or `blocked` (why).
 Bad: "Verify by running the tests." (that is not the real surface)
 
 Good: "Launch `bun run dev` (ready: `listening on :5173`, 30 s). Drive:
-`curl -s localhost:5173/api/health` returns `{"ok":true}`. Evidence:
+`curl -s localhost:5173/api/health` returned `{"ok":true}`; screenshot of
+/settings at .workit-scratch/settings.png. Evidence:
 `workit check --name verify-web -- bun scripts/smoke.ts` exit 0."
 
 ## Check

package/skills/workit-verify-app/references/template.md

@@ -30,6 +30,8 @@ description: Launch, drive and observe <app> on its real surface (<cli|web|api>)
 ## Evidence
 `workit check --name verify-<app> -- <driver command>` records exit code and log.
 Screenshots go to `<tmp dir>/verify-<app>/<feature>.png`; cite the path.
+UI: also report a console or network observation. API: quote the real response.
+If the app cannot be run, say so plainly instead of claiming success.
 
 ## Cleanup
 `<command>` (stop servers, remove `<tmp dir>`).