@brainervirus/workit-cursor 8.20.0 → 8.21.0

package/dist/cursor-session-start.js

@@ -10767,11 +10767,62 @@ var init_host_session = __esm(() => {
   OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
 });
 
-// packages/workit-core/src/ledger.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
-import { createHash as createHash8, randomBytes as randomBytes2 } from "node:crypto";
+// packages/workit-core/src/hooks/standing-signal.ts
+import { createHash as createHash8 } from "node:crypto";
 import fs6 from "node:fs";
 import path8 from "node:path";
+var gitStoreDir = (cwd) => {
+  try {
+    for (let dir = path8.resolve(cwd);; dir = path8.dirname(dir)) {
+      const dotGit = path8.join(dir, ".git");
+      if (fs6.existsSync(dotGit)) {
+        let gitDir = dotGit;
+        if (fs6.statSync(dotGit).isFile()) {
+          const target = /^gitdir:\s*(.+)$/mu.exec(fs6.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+          if (!target)
+            return null;
+          gitDir = path8.resolve(dir, target);
+          const common = path8.join(gitDir, "commondir");
+          if (fs6.existsSync(common))
+            gitDir = path8.resolve(gitDir, fs6.readFileSync(common, "utf8").trim());
+        }
+        return path8.join(gitDir, "workit");
+      }
+      if (path8.dirname(dir) === dir)
+        return null;
+    }
+  } catch {
+    return null;
+  }
+}, standingRevFile = (store) => path8.join(store, "standing", "rev"), standingSeenFile = (store, session, agentId) => path8.join(store, "standing", "seen", `${createHash8("sha256").update(`${session}\x00${agentId ?? ""}`).digest("hex").slice(0, 32)}.json`), readStandingRev = (store) => {
+  try {
+    return fs6.readFileSync(standingRevFile(store), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}, readStandingSeen = (file) => {
+  try {
+    const value = JSON.parse(fs6.readFileSync(file, "utf8"));
+    return {
+      rev: typeof value.rev === "string" ? value.rev : null,
+      ids: Array.isArray(value.ids) ? value.ids.filter((id) => typeof id === "string") : []
+    };
+  } catch {
+    return { rev: null, ids: [] };
+  }
+}, writeStandingSeen = (file, seen) => {
+  try {
+    fs6.mkdirSync(path8.dirname(file), { recursive: true });
+    fs6.writeFileSync(file, JSON.stringify(seen));
+  } catch {}
+};
+var init_standing_signal = () => {};
+
+// packages/workit-core/src/ledger.ts
+import { spawnSync as spawnSync8 } from "node:child_process";
+import { createHash as createHash9, randomBytes as randomBytes2 } from "node:crypto";
+import fs7 from "node:fs";
+import path9 from "node:path";
 function resolveCommit(cwd, ref) {
   if (!safeRef(ref))
     return null;
@@ -10825,7 +10876,7 @@ function diffHash(cwd, base, head) {
   ], GIT_TIMEOUTS.worktree);
   if (!diff.ok || !diff.stdout)
     return null;
-  const hash = createHash8("sha256");
+  const hash = createHash9("sha256");
   for (const line of diff.stdout.split(`
 `)) {
     if (line.startsWith("index "))
@@ -10837,14 +10888,14 @@ function diffHash(cwd, base, head) {
   return `sha256:${hash.digest("hex")}`;
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path8.resolve(cwd));
+  const location = resolveStore(path9.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path8.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path9.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
   const lock = `${file}.lock`;
@@ -10870,15 +10921,15 @@ function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
 }
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs6.openSync(file, "a+", 384);
+    const fd = fs7.openSync(file, "a+", 384);
     try {
       if (process.platform !== "win32")
         tighten(fd);
-      const size = fs6.fstatSync(fd).size;
+      const size = fs7.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
         const last = Buffer.alloc(1);
-        fs6.readSync(fd, last, 0, 1, size - 1);
+        fs7.readSync(fd, last, 0, 1, size - 1);
         if (last[0] !== 10)
           fence = `
 `;
@@ -10887,17 +10938,17 @@ function appendLine(file, build, options) {
       if (!line.ok)
         return line;
       const bytes = Buffer.from(fence + line.value);
-      const written = fs6.writeSync(fd, bytes);
+      const written = fs7.writeSync(fd, bytes);
       if (written !== bytes.length)
         return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
       return { ok: true, value: undefined };
     } finally {
-      fs6.closeSync(fd);
+      fs7.closeSync(fd);
     }
   };
   try {
-    fs6.mkdirSync(path8.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path8.dirname(file)))
+    fs7.mkdirSync(path9.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path9.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -10952,8 +11003,8 @@ function readLedger(cwd, options = {}) {
   let text = "";
   let stat = null;
   try {
-    stat = fs6.statSync(file.value);
-    text = fs6.readFileSync(file.value, "utf8");
+    stat = fs7.statSync(file.value);
+    text = fs7.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return {
@@ -11085,7 +11136,7 @@ function ledgerTampering(cwd) {
   if (!file.ok)
     return [];
   try {
-    const stat = fs6.statSync(file.value);
+    const stat = fs7.statSync(file.value);
     const cached = tamperCache.get(file.value);
     if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
       return cached.breaks;
@@ -11367,6 +11418,27 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     warnings
   };
 }
+function activeStanding(rows, fanout, leads = null) {
+  const active = [];
+  for (const row of rows) {
+    if (row.fanout !== fanout || !fromLead(row, leads))
+      continue;
+    if (row.type === "standing" && typeof row.what === "string" && row.what.trim()) {
+      if (!row.superseded)
+        active.push(row);
+    } else if (row.type === "standing.cleared") {
+      const target = str(row.target);
+      if (target === null)
+        active.length = 0;
+      else {
+        const index = active.findIndex((order) => order.id === target);
+        if (index >= 0)
+          active.splice(index, 1);
+      }
+    }
+  }
+  return active;
+}
 var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, PASSING, FAILING, STRONG_RESULTS, PR_ROW_TYPES, err = (code, error, unblock) => ({
   ok: false,
   code,
@@ -11411,28 +11483,28 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, PASSING, FAILING, STRONG_RESULTS,
   if (process.platform !== "linux")
     return false;
   try {
-    return isNetworkFsType(fs6.statfsSync(dir).type);
+    return isNetworkFsType(fs7.statfsSync(dir).type);
   } catch {
     return false;
   }
 }, LOCK_WAIT_MS = 5000, LOCK_STALE_MS = 30000, LOCK_OWNER = "owner", lockToken = (lock) => {
   try {
-    return fs6.readFileSync(path8.join(lock, LOCK_OWNER), "utf8");
+    return fs7.readFileSync(path9.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 }, lockAgeMs = (lock) => {
-  for (const target of [path8.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path9.join(lock, LOCK_OWNER), lock]) {
     try {
-      return Date.now() - fs6.statSync(target).mtimeMs;
+      return Date.now() - fs7.statSync(target).mtimeMs;
     } catch {}
   }
   return null;
-}, ledgerLock, sha2562 = (text) => createHash8("sha256").update(text).digest("hex"), chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
+}, ledgerLock, sha2562 = (text) => createHash9("sha256").update(text).digest("hex"), chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
 ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
   for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
     const buffer = Buffer.alloc(span);
-    fs6.readSync(fd, buffer, 0, span, size - span);
+    fs7.readSync(fd, buffer, 0, span, size - span);
     const end = buffer.lastIndexOf(10);
     if (end < 0) {
       if (span === size)
@@ -11462,8 +11534,8 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
   return null;
 }, tighten = (fd) => {
   try {
-    if ((fs6.fstatSync(fd).mode & 63) !== 0)
-      fs6.fchmodSync(fd, 384);
+    if ((fs7.fstatSync(fd).mode & 63) !== 0)
+      fs7.fchmodSync(fd, 384);
   } catch {}
 }, sealed = (row, id, at, previous) => {
   const { prevHash: _prev, rowHash: _row, ...fields } = row;
@@ -11505,12 +11577,13 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
   if (row.self === true && !reasons.includes("no_session"))
     reasons.push("self");
   return reasons;
-}, OBSERVED_ONLY;
+}, fromLead = (row, leads) => leads === null || row.actor.session !== null && leads.includes(row.actor.session), OBSERVED_ONLY;
 var init_ledger = __esm(() => {
   init_store_lock();
   init_vcs_config();
   init_rev();
   init_host_session();
+  init_standing_signal();
   init_paths();
   PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
   FAILING = new Set(["failed", "blocked"]);
@@ -11536,14 +11609,14 @@ var init_ledger = __esm(() => {
   ledgerLock = {
     acquire(lock) {
       try {
-        fs6.mkdirSync(lock);
+        fs7.mkdirSync(lock);
       } catch (error) {
         if (error.code === "EEXIST")
           return null;
         throw error;
       }
       const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
-      fs6.writeFileSync(path8.join(lock, LOCK_OWNER), token);
+      fs7.writeFileSync(path9.join(lock, LOCK_OWNER), token);
       return token;
     },
     release(lock, token) {
@@ -11551,35 +11624,35 @@ var init_ledger = __esm(() => {
         return false;
       const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
       try {
-        fs6.renameSync(lock, tomb);
+        fs7.renameSync(lock, tomb);
       } catch {
         return false;
       }
       if (lockToken(tomb) !== token) {
         try {
-          fs6.renameSync(tomb, lock);
+          fs7.renameSync(tomb, lock);
         } catch {}
         return false;
       }
-      fs6.rmSync(tomb, { recursive: true, force: true });
+      fs7.rmSync(tomb, { recursive: true, force: true });
       return true;
     },
     token: lockToken,
     reap(lock, observed) {
       const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
       try {
-        fs6.renameSync(lock, tomb);
+        fs7.renameSync(lock, tomb);
       } catch {
         return false;
       }
       if (lockToken(tomb) === observed) {
-        fs6.rmSync(tomb, { recursive: true, force: true });
+        fs7.rmSync(tomb, { recursive: true, force: true });
         return true;
       }
       try {
-        fs6.renameSync(tomb, lock);
+        fs7.renameSync(tomb, lock);
       } catch {
-        fs6.rmSync(tomb, { recursive: true, force: true });
+        fs7.rmSync(tomb, { recursive: true, force: true });
       }
       return false;
     }
@@ -11613,7 +11686,7 @@ var init_ledger = __esm(() => {
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync2 } from "node:fs";
-import path9 from "node:path";
+import path10 from "node:path";
 function deriveRequirements(judgment, scope, constraints, verification = "self") {
   const out = [];
   const base = { scope, dependentAction: null };
@@ -11765,7 +11838,7 @@ var RULES, derived2 = (spec) => ({
     decisionIds: []
   };
 }, planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync2(path9.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync2(path10.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -12362,7 +12435,7 @@ var init_safe_write = () => {};
 
 // packages/workit-core/src/autonomy.ts
 import os4 from "node:os";
-import path10 from "node:path";
+import path11 from "node:path";
 function endpointOf(entry) {
   const raw = entry?.defaultEndpoint;
   if (raw === undefined)
@@ -12459,9 +12532,9 @@ var accountHome = () => {
   } catch {
     return os4.homedir();
   }
-}, grantsHome, grantsDir = () => path10.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
-  const configured = path10.resolve(resolveConfigDir());
-  return configured === path10.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path10.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+}, grantsHome, grantsDir = () => path11.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
+  const configured = path11.resolve(resolveConfigDir());
+  return configured === path11.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path11.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 }, GRANT_KINDS, DEFAULT_GRANTS, DEFAULT_ENDPOINTS, DEFAULT_ENDPOINT = "commit", isDefaultEndpoint = (value) => typeof value === "string" && DEFAULT_ENDPOINTS.includes(value), DEFAULT_VERIFICATION = "self", verificationOf = (entry) => entry?.verification === "independent" ? "independent" : "self", isGrantValue = (value) => value === true || value === false || value === "verified", normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value, fromAutoApprove = (value) => {
   if (value === true)
     return { push: true, pr: true, merge: "verified" };
@@ -12552,7 +12625,7 @@ function normalizeMaxBytes(value, options = {}) {
 }
 
 // node_modules/@openclaw/fs-safe/dist/bounded-read.js
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 function createScratchBuffer(maxBytes) {
   const initialReadBytes = Number.isFinite(maxBytes) ? Math.min(READ_CHUNK_BYTES, maxBytes + 1) : READ_CHUNK_BYTES;
   return Buffer.allocUnsafe(Math.max(1, initialReadBytes));
@@ -12575,7 +12648,7 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
   let total = 0;
   while (true) {
     const length = nextReadLength(total, maxBytes, scratch.length);
-    const bytesRead = fs7.readSync(fd, scratch, 0, length, null);
+    const bytesRead = fs8.readSync(fd, scratch, 0, length, null);
     if (bytesRead === 0) {
       return Buffer.concat(chunks, total);
     }
@@ -12589,9 +12662,9 @@ var init_bounded_read = __esm(() => {
 });
 
 // node_modules/@openclaw/fs-safe/dist/read-open-flags.js
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 function resolveReadOpenFlags(options) {
-  const constants = options?.constants ?? fs8.constants;
+  const constants = options?.constants ?? fs9.constants;
   const noFollow = process.platform !== "win32" && options?.followSymlinks !== true && typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
   const nonBlocking = process.platform !== "win32" && typeof constants.O_NONBLOCK === "number" ? constants.O_NONBLOCK : 0;
   return constants.O_RDONLY | noFollow | nonBlocking;
@@ -12601,7 +12674,7 @@ var init_read_open_flags = () => {};
 // node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
 import { randomBytes as randomBytes3 } from "node:crypto";
 import fsSync from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 function parseSidecarLockSnapshot(snapshot, parser) {
   return snapshot && { ...snapshot, payload: parseSidecarLockPayload(snapshot.raw, parser) };
 }
@@ -12629,13 +12702,13 @@ ${ownershipToken}
   return { raw, ownershipToken };
 }
 function relativeSidecarLockPath(lockRoot, lockPath) {
-  const resolved = path11.resolve(lockPath);
-  const lexicalRelative = path11.relative(lockRoot.rootDir, resolved);
-  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path11.sep}`) && !path11.isAbsolute(lexicalRelative) ? lexicalRelative : path11.relative(lockRoot.rootReal, resolved);
-  if (!relative || relative === ".." || relative.startsWith(`..${path11.sep}`) || path11.isAbsolute(relative)) {
+  const resolved = path12.resolve(lockPath);
+  const lexicalRelative = path12.relative(lockRoot.rootDir, resolved);
+  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path12.sep}`) && !path12.isAbsolute(lexicalRelative) ? lexicalRelative : path12.relative(lockRoot.rootReal, resolved);
+  if (!relative || relative === ".." || relative.startsWith(`..${path12.sep}`) || path12.isAbsolute(relative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock path is outside lockRoot");
   }
-  return relative.split(path11.sep).join(path11.posix.sep);
+  return relative.split(path12.sep).join(path12.posix.sep);
 }
 function parseSidecarLockPayload(raw, parser) {
   if (parser) {
@@ -12804,8 +12877,8 @@ function sleepSync(ms) {
 }
 
 // node_modules/@openclaw/fs-safe/dist/file-lock-sync.js
-import fs9 from "node:fs";
-import path12 from "node:path";
+import fs10 from "node:fs";
+import path13 from "node:path";
 function getSyncHeldLocks() {
   const globalWithState = globalThis;
   if (!globalWithState[SYNC_HELD_LOCKS_KEY]) {
@@ -12822,7 +12895,7 @@ function releaseAllSyncHeldLocks() {
     }
     try {
       if (held.fd !== undefined)
-        fs9.closeSync(held.fd);
+        fs10.closeSync(held.fd);
     } catch {}
     try {
       removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
@@ -12857,7 +12930,7 @@ function releaseSyncHeldLock(held) {
   if (held.fd !== undefined) {
     const fd = held.fd;
     held.fd = undefined;
-    fs9.closeSync(fd);
+    fs10.closeSync(fd);
   }
   removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
   heldLocks.delete(held.normalizedTargetPath);
@@ -12880,29 +12953,29 @@ function createSyncHeldLockHandle(held) {
   };
 }
 function canonicalLockParentSync(parent) {
-  return process.platform === "win32" ? fs9.realpathSync.native(parent) : fs9.realpathSync(parent);
+  return process.platform === "win32" ? fs10.realpathSync.native(parent) : fs10.realpathSync(parent);
 }
 function normalizeTargetPath(targetPath) {
-  const resolved = path12.resolve(targetPath);
-  fs9.mkdirSync(path12.dirname(resolved), { recursive: true });
+  const resolved = path13.resolve(targetPath);
+  fs10.mkdirSync(path13.dirname(resolved), { recursive: true });
   try {
-    return path12.join(canonicalLockParentSync(path12.dirname(resolved)), path12.basename(resolved));
+    return path13.join(canonicalLockParentSync(path13.dirname(resolved)), path13.basename(resolved));
   } catch {
     return resolved;
   }
 }
 function boundedLockPath(lockPath, lockRoot) {
-  const resolved = path12.resolve(lockPath);
+  const resolved = path13.resolve(lockPath);
   if (!lockRoot)
     return resolved;
   relativeSidecarLockPath(lockRoot, resolved);
-  const parent = path12.dirname(resolved);
+  const parent = path13.dirname(resolved);
   const parentReal = canonicalLockParentSync(parent);
-  const parentRelative = path12.relative(lockRoot.rootReal, parentReal);
-  if (parentRelative === ".." || parentRelative.startsWith(`..${path12.sep}`) || path12.isAbsolute(parentRelative)) {
+  const parentRelative = path13.relative(lockRoot.rootReal, parentReal);
+  if (parentRelative === ".." || parentRelative.startsWith(`..${path13.sep}`) || path13.isAbsolute(parentRelative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock parent is outside lockRoot");
   }
-  return path12.join(parentReal, path12.basename(resolved));
+  return path13.join(parentReal, path13.basename(resolved));
 }
 function defaultShouldReclaim(snapshot, staleMs, nowMs) {
   const createdAtMs = sidecarLockPayloadCreatedAtMs(snapshot.payload);
@@ -12912,7 +12985,7 @@ function defaultShouldReclaim(snapshot, staleMs, nowMs) {
 }
 function reclaimGuardExists(reclaimGuardPath) {
   try {
-    fs9.lstatSync(reclaimGuardPath);
+    fs10.lstatSync(reclaimGuardPath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT")
@@ -12976,19 +13049,19 @@ function acquireFileLockSync(targetPath, options) {
     const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
     let lockFileCreateDenied = false;
     try {
-      const noFollow = process.platform !== "win32" && typeof fs9.constants.O_NOFOLLOW === "number" ? fs9.constants.O_NOFOLLOW : 0;
+      const noFollow = process.platform !== "win32" && typeof fs10.constants.O_NOFOLLOW === "number" ? fs10.constants.O_NOFOLLOW : 0;
       try {
-        fd = fs9.openSync(lockPath, fs9.constants.O_WRONLY | fs9.constants.O_CREAT | fs9.constants.O_EXCL | noFollow, 384);
+        fd = fs10.openSync(lockPath, fs10.constants.O_WRONLY | fs10.constants.O_CREAT | fs10.constants.O_EXCL | noFollow, 384);
       } catch (error) {
         lockFileCreateDenied = isTransientLockFileDenial(error, lockPath);
         throw error;
       }
-      fs9.writeFileSync(fd, raw, "utf8");
-      fs9.fsyncSync(fd);
+      fs10.writeFileSync(fd, raw, "utf8");
+      fs10.fsyncSync(fd);
       const snapshot = {
         raw,
         payload,
-        stat: fs9.fstatSync(fd),
+        stat: fs10.fstatSync(fd),
         ownershipToken
       };
       const createdHeld = {
@@ -13023,8 +13096,8 @@ function acquireFileLockSync(targetPath, options) {
       return returnedHandle;
     } catch (error) {
       if (fd !== undefined) {
-        const failed = { payload: null, stat: fs9.fstatSync(fd) };
-        fs9.closeSync(fd);
+        const failed = { payload: null, stat: fs10.fstatSync(fd) };
+        fs10.closeSync(fd);
         fd = undefined;
         removeSidecarLockIfUnchangedSync(lockPath, failed);
       }
@@ -13073,7 +13146,7 @@ function acquireFileLockSync(targetPath, options) {
         })) {
           let ownsReclaimGuard = false;
           try {
-            fs9.mkdirSync(reclaimGuardPath);
+            fs10.mkdirSync(reclaimGuardPath);
             ownsReclaimGuard = true;
             if (removeSidecarLockIfUnchangedSync(lockPath, snapshot))
               continue;
@@ -13086,7 +13159,7 @@ function acquireFileLockSync(targetPath, options) {
           } finally {
             if (ownsReclaimGuard) {
               try {
-                fs9.rmdirSync(reclaimGuardPath);
+                fs10.rmdirSync(reclaimGuardPath);
               } catch {}
             }
           }
@@ -13119,13 +13192,13 @@ var init_file_lock = __esm(() => {
 
 // packages/workit-core/src/core/package-root.ts
 import { existsSync as existsSync3 } from "node:fs";
-import path13 from "node:path";
+import path14 from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = () => {
-  let dir = path13.dirname(fileURLToPath(import.meta.url));
+  let dir = path14.dirname(fileURLToPath(import.meta.url));
   while (true) {
-    const parent = path13.dirname(dir);
-    if (existsSync3(path13.join(dir, "package.json")) || parent === dir)
+    const parent = path14.dirname(dir);
+    if (existsSync3(path14.join(dir, "package.json")) || parent === dir)
       return dir;
     dir = parent;
   }
@@ -13134,12 +13207,12 @@ var init_package_root = () => {};
 
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import fs10 from "node:fs";
-import path14 from "node:path";
+import fs11 from "node:fs";
+import path15 from "node:path";
 function readLog(file, from = 0, expectSeq = null) {
   let fd;
   try {
-    fd = fs10.openSync(file, "r");
+    fd = fs11.openSync(file, "r");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -13148,13 +13221,13 @@ function readLog(file, from = 0, expectSeq = null) {
   let bytes;
   let size;
   try {
-    size = fs10.fstatSync(fd).size;
+    size = fs11.fstatSync(fd).size;
     if (from > size)
       throw new LogDamage(`${file}: shorter than its snapshot`);
     bytes = Buffer.alloc(size - from);
     let read = 0;
     while (read < bytes.length) {
-      const got = fs10.readSync(fd, bytes, read, bytes.length - read, from + read);
+      const got = fs11.readSync(fd, bytes, read, bytes.length - read, from + read);
       if (got === 0)
         break;
       read += got;
@@ -13162,7 +13235,7 @@ function readLog(file, from = 0, expectSeq = null) {
     bytes = bytes.subarray(0, read);
     size = from + read;
   } finally {
-    fs10.closeSync(fd);
+    fs11.closeSync(fd);
   }
   const events = [];
   let start = 0;
@@ -13188,46 +13261,46 @@ function readLog(file, from = 0, expectSeq = null) {
 function appendEvent(file, event, validEnd) {
   const line = Buffer.from(`${JSON.stringify(event)}
 `, "utf8");
-  const created = !fs10.existsSync(file);
-  if (!created && fs10.statSync(file).size !== validEnd) {
-    const cut = fs10.openSync(file, "r+");
+  const created = !fs11.existsSync(file);
+  if (!created && fs11.statSync(file).size !== validEnd) {
+    const cut = fs11.openSync(file, "r+");
     try {
-      fs10.ftruncateSync(cut, validEnd);
-      fs10.fsyncSync(cut);
+      fs11.ftruncateSync(cut, validEnd);
+      fs11.fsyncSync(cut);
     } finally {
-      fs10.closeSync(cut);
+      fs11.closeSync(cut);
     }
   }
-  const fd = fs10.openSync(file, "a", 384);
+  const fd = fs11.openSync(file, "a", 384);
   try {
     let written = 0;
     while (written < line.length)
-      written += fs10.writeSync(fd, line, written, line.length - written);
-    fs10.fsyncSync(fd);
+      written += fs11.writeSync(fd, line, written, line.length - written);
+    fs11.fsyncSync(fd);
   } finally {
-    fs10.closeSync(fd);
+    fs11.closeSync(fd);
   }
   if (created)
-    fsyncDirectory(path14.dirname(file));
+    fsyncDirectory(path15.dirname(file));
   return validEnd;
 }
 function replaceFile(file, bytes, durable) {
   const temporary = `${file}.${process.pid}.${randomUUID2()}.tmp`;
   try {
-    const fd = fs10.openSync(temporary, "wx", 384);
+    const fd = fs11.openSync(temporary, "wx", 384);
     try {
-      fs10.writeSync(fd, bytes);
+      fs11.writeSync(fd, bytes);
       if (durable)
-        fs10.fsyncSync(fd);
+        fs11.fsyncSync(fd);
     } finally {
-      fs10.closeSync(fd);
+      fs11.closeSync(fd);
     }
     renameWithRetry(temporary, file);
     if (durable)
-      fsyncDirectory(path14.dirname(file));
+      fsyncDirectory(path15.dirname(file));
   } catch (error) {
     try {
-      fs10.unlinkSync(temporary);
+      fs11.unlinkSync(temporary);
     } catch {}
     throw error;
   }
@@ -13248,11 +13321,11 @@ var EVENT_VERSION = 1, LogDamage, isObject4 = (value) => typeof value === "objec
   return value;
 }, fsyncDirectory = (dir) => {
   try {
-    const fd = fs10.openSync(dir, "r");
+    const fd = fs11.openSync(dir, "r");
     try {
-      fs10.fsyncSync(fd);
+      fs11.fsyncSync(fd);
     } finally {
-      fs10.closeSync(fd);
+      fs11.closeSync(fd);
     }
   } catch (error) {
     if (process.platform !== "win32")
@@ -13275,7 +13348,7 @@ var EVENT_VERSION = 1, LogDamage, isObject4 = (value) => typeof value === "objec
       Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5 * (attempt + 1));
     }
   }
-}, renameWithRetry = (from, to) => retryTransient(() => fs10.renameSync(from, to));
+}, renameWithRetry = (from, to) => retryTransient(() => fs11.renameSync(from, to));
 var init_event_log = __esm(() => {
   LogDamage = class LogDamage extends Error {
     upgrade;
@@ -13394,7 +13467,7 @@ var isPlainObject2 = (value) => typeof value === "object" && value !== null && !
 });
 
 // packages/workit-core/src/store/reduce.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 function reduce(state, event, blobs) {
   const data = event.data;
   const known = KNOWN_TYPES.has(event.type);
@@ -13461,7 +13534,7 @@ function eventType(before, after) {
     return "task.noted";
   return "task.updated";
 }
-var OPENING_TYPES, KNOWN_TYPES, isObject5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), isKey = (value) => isObject5(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string"), BLOB_REF = "$blob", blobRef = (value) => isObject5(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null, blobDigest = (value) => createHash9("sha256").update(JSON.stringify(value)).digest("hex"), toBlob = (value, blobs) => {
+var OPENING_TYPES, KNOWN_TYPES, isObject5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), isKey = (value) => isObject5(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string"), BLOB_REF = "$blob", blobRef = (value) => isObject5(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null, blobDigest = (value) => createHash10("sha256").update(JSON.stringify(value)).digest("hex"), toBlob = (value, blobs) => {
   if (!isObject5(value))
     return value;
   const digest = blobDigest(value);
@@ -13532,9 +13605,9 @@ var init_notes = __esm(() => {
 });
 
 // packages/workit-core/src/core/task-store.ts
-import { createHash as createHash10, randomUUID as randomUUID3 } from "node:crypto";
-import * as fs11 from "node:fs";
-import path15 from "node:path";
+import { createHash as createHash11, randomUUID as randomUUID3 } from "node:crypto";
+import * as fs12 from "node:fs";
+import path16 from "node:path";
 
 class TaskStore {
   root;
@@ -13546,8 +13619,8 @@ class TaskStore {
   migrationChecked = false;
   compactDue = new Set;
   constructor(root, options = {}) {
-    const resolved = path15.resolve(root);
-    this.origin = fs11.existsSync(resolved) ? fs11.realpathSync(resolved) : resolved;
+    const resolved = path16.resolve(root);
+    this.origin = fs12.existsSync(resolved) ? fs12.realpathSync(resolved) : resolved;
     this.located = resolveStore(this.origin);
     this.root = checkoutRootOf(this.origin, this.located);
     this.lockTimeoutMs = options.lockTimeoutMs ?? defaultLockTimeout();
@@ -13555,7 +13628,7 @@ class TaskStore {
     this.migrateOnRead = options.migrateOnRead;
   }
   location() {
-    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs11.existsSync(path15.join(this.root, ".git"))) {
+    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs12.existsSync(path16.join(this.root, ".git"))) {
       this.located = undefined;
       this.migrationChecked = false;
     }
@@ -13619,7 +13692,7 @@ class TaskStore {
     const tasksDir = this.paths().tasks;
     let names;
     try {
-      names = fs11.existsSync(tasksDir) ? fs11.readdirSync(tasksDir).filter((name) => validId(name)) : [];
+      names = fs12.existsSync(tasksDir) ? fs12.readdirSync(tasksDir).filter((name) => validId(name)) : [];
     } catch (error) {
       return failure2("storage_error", `unable to list tasks: ${String(error)}`, {
         path: tasksDir
@@ -13660,7 +13733,7 @@ class TaskStore {
     const file = this.paths().workspace;
     let bytes;
     try {
-      bytes = retryTransient(() => fs11.readFileSync(file, "utf8"));
+      bytes = retryTransient(() => fs12.readFileSync(file, "utf8"));
     } catch (error) {
       if (error.code === "ENOENT")
         return success(null, null, null);
@@ -13711,7 +13784,7 @@ class TaskStore {
         const moved = this.bindLocked(again.data.id, key, input.now);
         return moved.ok ? success(moved.data.revision, null, { task: moved.data, created: false, key }) : moved;
       }
-      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path15.basename(this.root) || this.root;
+      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path16.basename(this.root) || this.root;
       const intent = {
         objective: input.objective?.trim() || `Work on ${label}`,
         scope: { description: `the checkout (${label})`, paths: ["."], exclusions: [] },
@@ -13777,14 +13850,14 @@ class TaskStore {
     const branch = key.ok ? key.data.branch : null;
     if (!branch || !location.ok)
       return success(null, null, null);
-    const common = path15.dirname(location.data.dir);
-    const heads = path15.join(common, "logs", "refs", "heads");
-    const headLog = location.data.git ? path15.join(location.data.git.gitDir, "logs", "HEAD") : "";
+    const common = path16.dirname(location.data.dir);
+    const heads = path16.join(common, "logs", "refs", "heads");
+    const headLog = location.data.git ? path16.join(location.data.git.gitDir, "logs", "HEAD") : "";
     const signatures = [
-      path15.join(heads, branch),
+      path16.join(heads, branch),
       headLog,
       heads,
-      path15.join(common, "packed-refs")
+      path16.join(common, "packed-refs")
     ].map((file) => fileSignature(file) ?? "-");
     const slot = `${location.data.dir}\x00${headLog}\x00${branch}`;
     let resolved = origins.get(slot);
@@ -13796,7 +13869,7 @@ class TaskStore {
           aliases.push(rename.from);
       const start = branchStart(location.data, branch, aliases);
       const slash = start?.indexOf("/") ?? -1;
-      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path15.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
+      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path16.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
       const name = start && (remote ? start.slice(slash + 1) : start);
       resolved = {
         signature: signatures.join("|"),
@@ -14034,13 +14107,13 @@ class TaskStore {
     if (!ready.ok)
       return ready;
     const dirs = this.paths();
-    const recovery = path15.join(this.root, ".workit", "recovery");
-    if (fs11.existsSync(recovery)) {
+    const recovery = path16.join(this.root, ".workit", "recovery");
+    if (fs12.existsSync(recovery)) {
       let files = 0;
       let bytes = 0;
       try {
-        for (const name of fs11.readdirSync(recovery)) {
-          const stat = fs11.lstatSync(path15.join(recovery, name));
+        for (const name of fs12.readdirSync(recovery)) {
+          const stat = fs12.lstatSync(path16.join(recovery, name));
           if (!stat.isFile())
             continue;
           files += 1;
@@ -14049,17 +14122,17 @@ class TaskStore {
       } catch {}
       const remove = options.pruneRecovery === true && !dryRun;
       if (remove)
-        fs11.rmSync(recovery, { recursive: true, force: true });
+        fs12.rmSync(recovery, { recursive: true, force: true });
       report.legacyRecovery = { path: recovery, files, bytes, removed: remove };
     }
-    if (!fs11.existsSync(dirs.tasks))
+    if (!fs12.existsSync(dirs.tasks))
       return success(null, null, report);
-    const names = fs11.readdirSync(dirs.tasks).filter((name) => validId(name));
+    const names = fs12.readdirSync(dirs.tasks).filter((name) => validId(name));
     for (const name of names) {
       const file = this.eventsPath(name);
       let size = 0;
       try {
-        size = fs11.statSync(file).size;
+        size = fs12.statSync(file).size;
       } catch {
         continue;
       }
@@ -14087,16 +14160,16 @@ class TaskStore {
       const references = new Set;
       for (const name of names)
         try {
-          for (const match of fs11.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
+          for (const match of fs12.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
             references.add(match[1]);
         } catch {}
-      if (fs11.existsSync(dirs.blobs))
-        for (const name of fs11.readdirSync(dirs.blobs)) {
+      if (fs12.existsSync(dirs.blobs))
+        for (const name of fs12.readdirSync(dirs.blobs)) {
           const digest = name.replace(/\.json$/, "");
-          const file = path15.join(dirs.blobs, name);
+          const file = path16.join(dirs.blobs, name);
           let stat;
           try {
-            stat = fs11.lstatSync(file);
+            stat = fs12.lstatSync(file);
           } catch {
             continue;
           }
@@ -14107,11 +14180,11 @@ class TaskStore {
           report.blobs.removed += 1;
           report.blobs.removedBytes += stat.size;
           if (!dryRun)
-            fs11.rmSync(file, { force: true });
+            fs12.rmSync(file, { force: true });
         }
       return success(null, null, null);
     };
-    const swept = dryRun ? sweep() : this.withLock(path15.join(dirs.dir, "gc.lock"), sweep);
+    const swept = dryRun ? sweep() : this.withLock(path16.join(dirs.dir, "gc.lock"), sweep);
     if (!swept.ok)
       return swept;
     const temporaryDirs = [
@@ -14119,17 +14192,17 @@ class TaskStore {
       dirs.tasks,
       dirs.blobs,
       dirs.checkout,
-      ...names.map((name) => path15.join(dirs.tasks, name))
+      ...names.map((name) => path16.join(dirs.tasks, name))
     ];
     for (const directory of temporaryDirs) {
-      if (!fs11.existsSync(directory))
+      if (!fs12.existsSync(directory))
         continue;
-      for (const name of fs11.readdirSync(directory)) {
+      for (const name of fs12.readdirSync(directory)) {
         if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
           continue;
-        const file = path15.join(directory, name);
+        const file = path16.join(directory, name);
         try {
-          const stat = fs11.lstatSync(file);
+          const stat = fs12.lstatSync(file);
           if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
             continue;
         } catch {
@@ -14137,37 +14210,37 @@ class TaskStore {
         }
         report.temporary.removed += 1;
         if (!dryRun)
-          fs11.rmSync(file, { force: true });
+          fs12.rmSync(file, { force: true });
       }
     }
     return success(null, null, report);
   }
   paths() {
     const location = this.location();
-    const dir = location.ok ? location.data.dir : path15.join(this.root, ".workit");
-    const checkout = path15.join(dir, "checkouts", checkoutSlug(this.root));
+    const dir = location.ok ? location.data.dir : path16.join(this.root, ".workit");
+    const checkout = path16.join(dir, "checkouts", checkoutSlug(this.root));
     return {
       dir,
       shared: location.ok ? location.data.shared : false,
-      marker: path15.join(dir, "store.json"),
+      marker: path16.join(dir, "store.json"),
       checkout,
-      workspace: path15.join(checkout, "workspace.json"),
-      checkoutLock: path15.join(checkout, "metadata.lock"),
-      tasks: path15.join(dir, "tasks"),
-      index: path15.join(dir, "task-index.json"),
-      blobs: path15.join(dir, "blobs", "candidates"),
-      legacy: path15.join(dir, "legacy", checkoutSlug(this.root), "v2"),
-      v2: path15.join(this.root, ".workit")
+      workspace: path16.join(checkout, "workspace.json"),
+      checkoutLock: path16.join(checkout, "metadata.lock"),
+      tasks: path16.join(dir, "tasks"),
+      index: path16.join(dir, "task-index.json"),
+      blobs: path16.join(dir, "blobs", "candidates"),
+      legacy: path16.join(dir, "legacy", checkoutSlug(this.root), "v2"),
+      v2: path16.join(this.root, ".workit")
     };
   }
   eventsPath(taskId) {
-    return path15.join(this.paths().tasks, taskId, "events.jsonl");
+    return path16.join(this.paths().tasks, taskId, "events.jsonl");
   }
   snapshotPath(taskId) {
-    return path15.join(this.paths().tasks, taskId, "snapshot.json");
+    return path16.join(this.paths().tasks, taskId, "snapshot.json");
   }
   taskLockPath(taskId) {
-    return path15.join(this.paths().tasks, taskId, "lock");
+    return path16.join(this.paths().tasks, taskId, "lock");
   }
   ready(write = false) {
     const location = this.location();
@@ -14177,7 +14250,7 @@ class TaskStore {
       return success(null, null, null);
     const dirs = this.paths();
     try {
-      const marker = JSON.parse(fs11.readFileSync(dirs.marker, "utf8"));
+      const marker = JSON.parse(fs12.readFileSync(dirs.marker, "utf8"));
       if (typeof marker.version === "number" && marker.version > STORE_FORMAT)
         return failure2("recovery_required", `the workit store at ${dirs.dir} has format ${marker.version}; upgrade Workit to use it`, { path: dirs.marker });
     } catch {}
@@ -14206,21 +14279,21 @@ class TaskStore {
     return {
       read: (digest) => {
         try {
-          return JSON.parse(fs11.readFileSync(path15.join(dir, `${digest}.json`), "utf8"));
+          return JSON.parse(fs12.readFileSync(path16.join(dir, `${digest}.json`), "utf8"));
         } catch (error) {
           throw new LogDamage(`stored candidate ${digest} is missing or unreadable: ${String(error)}`);
         }
       },
       write: (digest, value) => {
-        const file = path15.join(dir, `${digest}.json`);
-        if (fs11.existsSync(file)) {
+        const file = path16.join(dir, `${digest}.json`);
+        if (fs12.existsSync(file)) {
           const stamp = new Date;
           try {
-            fs11.utimesSync(file, stamp, stamp);
+            fs12.utimesSync(file, stamp, stamp);
             return;
           } catch {}
         }
-        fs11.mkdirSync(dir, { recursive: true });
+        fs12.mkdirSync(dir, { recursive: true });
         replaceFile(file, JSON.stringify(value), true);
       }
     };
@@ -14302,7 +14375,7 @@ class TaskStore {
   }
   readSnapshot(taskId) {
     try {
-      const value = JSON.parse(fs11.readFileSync(this.snapshotPath(taskId), "utf8"));
+      const value = JSON.parse(fs12.readFileSync(this.snapshotPath(taskId), "utf8"));
       if (!isObject6(value) || value.v !== 1 || value.task !== taskId || typeof value.seq !== "number" || typeof value.lastId !== "string" || typeof value.lastStart !== "number" || typeof value.end !== "number" || !isObject6(value.record))
         return null;
       return value;
@@ -14404,8 +14477,8 @@ class TaskStore {
     }
   }
   openTask(record, type, key, legacy = null) {
-    const dir = path15.join(this.paths().tasks, record.id);
-    fs11.mkdirSync(dir, { recursive: true });
+    const dir = path16.join(this.paths().tasks, record.id);
+    fs12.mkdirSync(dir, { recursive: true });
     const blobs = this.blobStore();
     const bound = key ? { ...key, boundAt: key.boundAt ?? new Date().toISOString() } : null;
     const event = this.event(record.id, 1, type, {
@@ -14457,11 +14530,11 @@ class TaskStore {
         } catch {}
         if (!latest || latest.events[0]?.id !== last.id)
           return failure2("busy", "the task log changed during compaction; retry", { taskId });
-        const appended = fs11.readFileSync(file).subarray(log.end, latest.end);
+        const appended = fs12.readFileSync(file).subarray(log.end, latest.end);
         const bytes = Buffer.concat([Buffer.from(prefix, "utf8"), appended]);
         replaceFile(file, bytes.toString("utf8"), true);
         try {
-          fs11.rmSync(this.snapshotPath(taskId), { force: true });
+          fs12.rmSync(this.snapshotPath(taskId), { force: true });
         } catch {}
         const reloaded = this.load(taskId);
         if (reloaded.ok && reloaded.data)
@@ -14474,7 +14547,7 @@ class TaskStore {
   }
   countEvents(file) {
     try {
-      const bytes = fs11.readFileSync(file);
+      const bytes = fs12.readFileSync(file);
       let count = 0;
       for (let index = bytes.indexOf(10);index >= 0; index = bytes.indexOf(10, index + 1))
         count += 1;
@@ -14496,8 +14569,8 @@ class TaskStore {
     return bound.ok ? success(null, null, bound.data[0] ?? null) : bound;
   }
   withKeyLock(key, operation) {
-    const digest = createHash10("sha256").update(key).digest("hex").slice(0, 32);
-    return this.withLock(path15.join(this.paths().dir, "keys", `${digest}.lock`), operation);
+    const digest = createHash11("sha256").update(key).digest("hex").slice(0, 32);
+    return this.withLock(path16.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
     const current = this.readWorkspace();
@@ -14638,7 +14711,7 @@ class TaskStore {
   writeWorkspace(record) {
     const file = this.paths().workspace;
     try {
-      fs11.mkdirSync(path15.dirname(file), { recursive: true });
+      fs12.mkdirSync(path16.dirname(file), { recursive: true });
       replaceFile(file, `${canonicalJson(record)}
 `, true);
       return success(null, null, null);
@@ -14648,7 +14721,7 @@ class TaskStore {
   }
   readIndex() {
     try {
-      const value = JSON.parse(fs11.readFileSync(this.paths().index, "utf8"));
+      const value = JSON.parse(fs12.readFileSync(this.paths().index, "utf8"));
       if (!isObject6(value) || value.version !== INDEX_VERSION || !isObject6(value.tasks))
         return {};
       const tasks = {};
@@ -14662,7 +14735,7 @@ class TaskStore {
   }
   writeIndex(entries) {
     try {
-      fs11.mkdirSync(this.paths().tasks, { recursive: true });
+      fs12.mkdirSync(this.paths().tasks, { recursive: true });
       replaceFile(this.paths().index, JSON.stringify({
         version: INDEX_VERSION,
         tasks: Object.fromEntries(entries.map((entry) => [entry.id, entry]))
@@ -14716,23 +14789,23 @@ class TaskStore {
     return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
   }
   v2Dirs() {
-    return [...new Set([this.root, this.origin])].map((dir) => path15.join(dir, ".workit"));
+    return [...new Set([this.root, this.origin])].map((dir) => path16.join(dir, ".workit"));
   }
   pendingMigrations() {
     return this.v2Dirs().filter((dir) => {
-      const raw = this.readV2Workspace(path15.join(dir, "workspace.json"));
+      const raw = this.readV2Workspace(path16.join(dir, "workspace.json"));
       return raw !== null && raw !== TOMBSTONE;
     });
   }
   migrateV2(v2) {
     const dirs = this.paths();
-    const v2Workspace = path15.join(v2, "workspace.json");
-    const v2Tasks = path15.join(v2, "tasks");
-    const legacy = path15.join(dirs.dir, "legacy", checkoutSlug(path15.dirname(v2)), "v2");
+    const v2Workspace = path16.join(v2, "workspace.json");
+    const v2Tasks = path16.join(v2, "tasks");
+    const legacy = path16.join(dirs.dir, "legacy", checkoutSlug(path16.dirname(v2)), "v2");
     const raw = this.readV2Workspace(v2Workspace);
     if (raw === null || raw === TOMBSTONE)
       return success(null, null, null);
-    return this.withLock(dirs.checkoutLock, () => this.withLock(path15.join(v2, "metadata.lock"), () => {
+    return this.withLock(dirs.checkoutLock, () => this.withLock(path16.join(v2, "metadata.lock"), () => {
       const workspace = this.readV2Workspace(v2Workspace);
       if (workspace === null || workspace === TOMBSTONE)
         return success(null, null, null);
@@ -14741,7 +14814,7 @@ class TaskStore {
         return failure2("recovery_required", `cannot migrate the 2.x store at ${v2}: ${parsedWorkspace.error}; move it aside to start fresh`, { path: v2Workspace });
       let files = [];
       try {
-        files = fs11.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path15.join(v2Tasks, name)));
+        files = fs12.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path16.join(v2Tasks, name)));
       } catch {}
       const current = this.readWorkspace();
       if (!current.ok)
@@ -14759,22 +14832,22 @@ class TaskStore {
       let skipped = 0;
       const done = new Map;
       try {
-        fs11.mkdirSync(path15.join(legacy, "tasks"), { recursive: true });
+        fs12.mkdirSync(path16.join(legacy, "tasks"), { recursive: true });
         for (const name of ["workspace.json", "index.json"])
-          if (fs11.existsSync(path15.join(v2, name)))
-            fs11.copyFileSync(path15.join(v2, name), path15.join(legacy, name));
+          if (fs12.existsSync(path16.join(v2, name)))
+            fs12.copyFileSync(path16.join(v2, name), path16.join(legacy, name));
         for (const name of files) {
           const id = name.slice(0, -5);
-          const file = path15.join(v2Tasks, name);
-          const bytes = fs11.readFileSync(file, "utf8");
+          const file = path16.join(v2Tasks, name);
+          const bytes = fs12.readFileSync(file, "utf8");
           const digest = sha256(bytes);
-          fs11.writeFileSync(path15.join(legacy, "tasks", name), bytes);
+          fs12.writeFileSync(path16.join(legacy, "tasks", name), bytes);
           const parsed = this.parseRecord(bytes, taskRecordSchema, "2.x task");
           if (!parsed.ok || parsed.data.id !== id)
             return failure2("recovery_required", `cannot migrate 2.x task ${id}: ${parsed.ok ? "file name and record ID differ" : parsed.error}; move ${file} aside to continue`, { path: file });
           const record = { ...parsed.data, workspaceId: target.id };
-          const origin = { path: path15.join(legacy, "tasks", name), digest };
-          if (!fs11.existsSync(this.eventsPath(id))) {
+          const origin = { path: path16.join(legacy, "tasks", name), digest };
+          if (!fs12.existsSync(this.eventsPath(id))) {
             this.openTask(record, "migrated.from_v2", null, origin);
             migrated += 1;
           } else {
@@ -14809,8 +14882,8 @@ class TaskStore {
       try {
         let complete = true;
         for (const [name, digest] of done) {
-          const file = path15.join(v2Tasks, name);
-          if (sha256(fs11.readFileSync(file, "utf8")) !== digest) {
+          const file = path16.join(v2Tasks, name);
+          if (sha256(fs12.readFileSync(file, "utf8")) !== digest) {
             complete = false;
             continue;
           }
@@ -14820,7 +14893,7 @@ class TaskStore {
           return failure2("busy", `the 2.x store at ${v2} changed during migration; retry`, {
             path: v2
           });
-        fs11.rmSync(path15.join(v2, "index.json"), { force: true });
+        fs12.rmSync(path16.join(v2, "index.json"), { force: true });
         this.writeTombstone(v2, target.id);
       } catch (error) {
         return failure2("storage_error", `cannot finish the 2.x migration: ${String(error)}`, {
@@ -14840,45 +14913,45 @@ class TaskStore {
   }
   adoptLocalStore() {
     const dirs = this.paths();
-    const marker = path15.join(dirs.v2, "store.json");
-    if (!dirs.shared || !fs11.existsSync(marker))
+    const marker = path16.join(dirs.v2, "store.json");
+    if (!dirs.shared || !fs12.existsSync(marker))
       return success(null, null, null);
     return this.withLock(dirs.checkoutLock, () => {
-      if (!fs11.existsSync(marker))
+      if (!fs12.existsSync(marker))
         return success(null, null, null);
       let tasks = 0;
       try {
         const merge = (from, to) => {
-          if (!fs11.existsSync(to)) {
-            fs11.mkdirSync(path15.dirname(to), { recursive: true });
+          if (!fs12.existsSync(to)) {
+            fs12.mkdirSync(path16.dirname(to), { recursive: true });
             try {
-              fs11.renameSync(from, to);
+              fs12.renameSync(from, to);
             } catch {
-              fs11.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
-              fs11.rmSync(from, { recursive: true, force: true });
+              fs12.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
+              fs12.rmSync(from, { recursive: true, force: true });
             }
             return;
           }
-          if (fs11.lstatSync(from).isDirectory() && fs11.lstatSync(to).isDirectory())
-            for (const name of fs11.readdirSync(from))
-              merge(path15.join(from, name), path15.join(to, name));
+          if (fs12.lstatSync(from).isDirectory() && fs12.lstatSync(to).isDirectory())
+            for (const name of fs12.readdirSync(from))
+              merge(path16.join(from, name), path16.join(to, name));
         };
         for (const sub of ["tasks", "checkouts", "blobs", "legacy"]) {
-          const from = path15.join(dirs.v2, sub);
-          if (!fs11.existsSync(from))
+          const from = path16.join(dirs.v2, sub);
+          if (!fs12.existsSync(from))
             continue;
           if (sub === "tasks") {
-            for (const name of fs11.readdirSync(from))
-              if (validId(name) && !fs11.existsSync(path15.join(dirs.dir, sub, name)))
+            for (const name of fs12.readdirSync(from))
+              if (validId(name) && !fs12.existsSync(path16.join(dirs.dir, sub, name)))
                 tasks += 1;
           }
-          merge(from, path15.join(dirs.dir, sub));
+          merge(from, path16.join(dirs.dir, sub));
         }
-        const ledger = path15.join(dirs.v2, "ledger");
-        if (fs11.existsSync(ledger) && !fs11.existsSync(path15.join(dirs.dir, "ledger")))
-          merge(ledger, path15.join(dirs.dir, "ledger"));
-        fs11.rmSync(path15.join(dirs.v2, "task-index.json"), { force: true });
-        fs11.renameSync(marker, path15.join(dirs.v2, "store.moved.json"));
+        const ledger = path16.join(dirs.v2, "ledger");
+        if (fs12.existsSync(ledger) && !fs12.existsSync(path16.join(dirs.dir, "ledger")))
+          merge(ledger, path16.join(dirs.dir, "ledger"));
+        fs12.rmSync(path16.join(dirs.v2, "task-index.json"), { force: true });
+        fs12.renameSync(marker, path16.join(dirs.v2, "store.moved.json"));
       } catch (error) {
         return failure2("storage_error", `cannot move ${dirs.v2} into ${dirs.dir}: ${String(error)}`, {
           path: dirs.v2
@@ -14898,7 +14971,7 @@ class TaskStore {
   readV2Workspace(file) {
     let bytes;
     try {
-      bytes = fs11.readFileSync(file, "utf8");
+      bytes = fs12.readFileSync(file, "utf8");
     } catch {
       return null;
     }
@@ -14916,7 +14989,7 @@ class TaskStore {
       schemaVersion: SCHEMA_VERSION,
       id: workspaceId ?? newId(),
       revision: newRevision(),
-      root: path15.dirname(v2),
+      root: path16.dirname(v2),
       runtime: { createdWith: version, updatedWith: version },
       writer: null,
       store: {
@@ -14927,12 +15000,12 @@ class TaskStore {
       },
       critical: ["store"]
     };
-    fs11.mkdirSync(v2, { recursive: true });
-    const ignore = path15.join(v2, ".gitignore");
-    if (!fs11.existsSync(ignore))
-      fs11.writeFileSync(ignore, `*
+    fs12.mkdirSync(v2, { recursive: true });
+    const ignore = path16.join(v2, ".gitignore");
+    if (!fs12.existsSync(ignore))
+      fs12.writeFileSync(ignore, `*
 `);
-    replaceFile(path15.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
+    replaceFile(path16.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
 `, true);
   }
   stubFor(taskId) {
@@ -14948,7 +15021,7 @@ class TaskStore {
   }
   isStub(file) {
     try {
-      const value = JSON.parse(fs11.readFileSync(file, "utf8"));
+      const value = JSON.parse(fs12.readFileSync(file, "utf8"));
       return isObject6(value) && isObject6(value.store) && value.store.format === "workit-store";
     } catch {
       return false;
@@ -14956,32 +15029,32 @@ class TaskStore {
   }
   writeTombstoneIfMissing() {
     try {
-      const v2 = path15.join(this.root, ".workit");
-      if (fs11.existsSync(path15.join(v2, "workspace.json")))
+      const v2 = path16.join(this.root, ".workit");
+      if (fs12.existsSync(path16.join(v2, "workspace.json")))
         return;
       let id = null;
       try {
-        id = JSON.parse(fs11.readFileSync(this.paths().workspace, "utf8")).id ?? null;
+        id = JSON.parse(fs12.readFileSync(this.paths().workspace, "utf8")).id ?? null;
       } catch {}
       this.writeTombstone(v2, id);
     } catch {}
   }
   initializeStorage() {
     const dirs = this.paths();
-    retryTransient(() => fs11.mkdirSync(dirs.checkout, { recursive: true }));
-    retryTransient(() => fs11.mkdirSync(dirs.tasks, { recursive: true }));
-    if (!fs11.existsSync(dirs.marker))
+    retryTransient(() => fs12.mkdirSync(dirs.checkout, { recursive: true }));
+    retryTransient(() => fs12.mkdirSync(dirs.tasks, { recursive: true }));
+    if (!fs12.existsSync(dirs.marker))
       replaceFile(dirs.marker, `${JSON.stringify({ format: "workit-store", version: STORE_FORMAT, createdWith: runtimeVersion() })}
 `, false);
     if (!dirs.shared) {
-      const ignore = path15.join(dirs.dir, ".gitignore");
+      const ignore = path16.join(dirs.dir, ".gitignore");
       let current = null;
       try {
-        current = fs11.readFileSync(ignore, "utf8");
+        current = fs12.readFileSync(ignore, "utf8");
       } catch {}
       if (current !== `*
 `)
-        retryTransient(() => fs11.writeFileSync(ignore, `*
+        retryTransient(() => fs12.writeFileSync(ignore, `*
 `));
     }
     this.writeTombstoneIfMissing();
@@ -14997,7 +15070,7 @@ class TaskStore {
       shouldReclaim: ({ payload, nowMs }) => {
         let ageMs = null;
         try {
-          ageMs = nowMs - fs11.lstatSync(lockPath).mtimeMs;
+          ageMs = nowMs - fs12.lstatSync(lockPath).mtimeMs;
         } catch {}
         return classifyLockOwner(payload, ageMs, localLockHost(), TASK_STORE_LOCK).state === "stale";
       },
@@ -15034,7 +15107,7 @@ class TaskStore {
   withLock(lockPath, operation) {
     try {
       this.initializeStorage();
-      fs11.mkdirSync(path15.dirname(lockPath), { recursive: true });
+      fs12.mkdirSync(path16.dirname(lockPath), { recursive: true });
     } catch (error) {
       return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.paths().dir
@@ -15074,18 +15147,18 @@ class TaskStore {
   lockDirWritable(lockPath) {
     const probe = `${lockPath}.${process.pid}.${randomUUID3()}.probe`;
     try {
-      fs11.closeSync(fs11.openSync(probe, "wx", 384));
+      fs12.closeSync(fs12.openSync(probe, "wx", 384));
     } catch {
       return false;
     }
     try {
-      fs11.rmSync(probe, { force: true });
+      fs12.rmSync(probe, { force: true });
     } catch {}
     return true;
   }
   lockHolderPresent(lockPath) {
     try {
-      fs11.lstatSync(lockPath);
+      fs12.lstatSync(lockPath);
       return true;
     } catch (error) {
       return error?.code !== "ENOENT";
@@ -15097,12 +15170,12 @@ class TaskStore {
     if (isTransientWindowsError(error) && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
       return failure2("storage_error", `cannot create the workit lock (${code}); no other Workit call holds it`, {
         path: lockPath,
-        guidance: `Check permissions and the read-only attribute on ${path15.dirname(lockPath)}.`
+        guidance: `Check permissions and the read-only attribute on ${path16.dirname(lockPath)}.`
       });
     if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
       let lock = null;
       try {
-        lock = parseMetadataLockOrNull(fs11.readFileSync(lockPath, "utf8"));
+        lock = parseMetadataLockOrNull(fs12.readFileSync(lockPath, "utf8"));
       } catch {}
       return failure2("busy", `workit lock is held by another Workit call${lock ? ` (pid ${lock.pid} on ${lock.host})` : ""}; retry shortly`, {
         outcome: "not_started",
@@ -15143,7 +15216,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
   };
 }, fileSignature = (file) => {
   try {
-    const stat = fs11.statSync(file, { bigint: true });
+    const stat = fs12.statSync(file, { bigint: true });
     return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
   } catch {
     return null;
@@ -15155,7 +15228,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
 }, now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"), oldestFirst = (left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id), cachedRuntimeVersion = null, runtimeVersion = () => {
   if (cachedRuntimeVersion === null) {
     try {
-      const pkg = JSON.parse(fs11.readFileSync(path15.join(packageRoot(), "package.json"), "utf8"));
+      const pkg = JSON.parse(fs12.readFileSync(path16.join(packageRoot(), "package.json"), "utf8"));
       cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
     } catch {
       cachedRuntimeVersion = "0.0.0";
@@ -15177,12 +15250,12 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
   return false;
 }, validId = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value), readText = (file) => {
   try {
-    return fs11.readFileSync(file, "utf8");
+    return fs12.readFileSync(file, "utf8");
   } catch {
     return "";
   }
 }, REFLOG_LINE, branchStart = (location, branch, aliases) => {
-  const first = readText(path15.join(path15.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
+  const first = readText(path16.join(path16.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
 `, 1)[0];
   const created = REFLOG_LINE.exec(first);
   const start = created && /^branch: Created from (\S+)$/u.exec(created[3])?.[1];
@@ -15192,7 +15265,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
     return start;
   if (!location.git)
     return null;
-  for (const line of readText(path15.join(location.git.gitDir, "logs", "HEAD")).split(`
+  for (const line of readText(path16.join(location.git.gitDir, "logs", "HEAD")).split(`
 `)) {
     const entry = REFLOG_LINE.exec(line);
     const moved = entry && /^checkout: moving from (\S+) to (\S+)$/u.exec(entry[3]);
@@ -15201,21 +15274,21 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
       return moved[1];
   }
   return null;
-}, refExists = (common, ref) => fs11.existsSync(path15.join(common, ref)) || readText(path15.join(common, "packed-refs")).includes(` ${ref}
+}, refExists = (common, ref) => fs12.existsSync(path16.join(common, ref)) || readText(path16.join(common, "packed-refs")).includes(` ${ref}
 `), origins, sameDirectoryIdentity = (left, right) => {
-  if (!path15.isAbsolute(left) || !path15.isAbsolute(right))
+  if (!path16.isAbsolute(left) || !path16.isAbsolute(right))
     return false;
-  const normalizedLeft = path15.resolve(left);
-  const normalizedRight = path15.resolve(right);
+  const normalizedLeft = path16.resolve(left);
+  const normalizedRight = path16.resolve(right);
   try {
-    const a = fs11.statSync(normalizedLeft, { bigint: true });
-    const b = fs11.statSync(normalizedRight, { bigint: true });
+    const a = fs12.statSync(normalizedLeft, { bigint: true });
+    const b = fs12.statSync(normalizedRight, { bigint: true });
     if (!a.isDirectory() || !b.isDirectory())
       return false;
     if (process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight)
       return true;
-    const canonicalLeft = fs11.realpathSync(normalizedLeft);
-    const canonicalRight = fs11.realpathSync(normalizedRight);
+    const canonicalLeft = fs12.realpathSync(normalizedLeft);
+    const canonicalRight = fs12.realpathSync(normalizedRight);
     if (process.platform === "win32" ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase() : canonicalLeft === canonicalRight)
       return true;
     return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
@@ -15263,16 +15336,16 @@ var init_workers = __esm(() => {
 
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import fs12 from "node:fs";
-import path16 from "node:path";
+import fs13 from "node:fs";
+import path17 from "node:path";
 function checksConfigFile(root) {
-  const current = path16.join(root, CHECKS_FILE);
-  const legacy = path16.join(root, LEGACY_CHECKS_FILE);
-  return !fs12.existsSync(current) && fs12.existsSync(legacy) ? legacy : current;
+  const current = path17.join(root, CHECKS_FILE);
+  const legacy = path17.join(root, LEGACY_CHECKS_FILE);
+  return !fs13.existsSync(current) && fs13.existsSync(legacy) ? legacy : current;
 }
 function repoHeavyCommands(root) {
   try {
-    const value = JSON.parse(fs12.readFileSync(checksConfigFile(root), "utf8"));
+    const value = JSON.parse(fs13.readFileSync(checksConfigFile(root), "utf8"));
     const resources = isRecord3(value) ? value.resources : undefined;
     const list = isRecord3(resources) ? resources.heavyCommands : undefined;
     return Array.isArray(list) ? list.filter((item) => typeof item === "string") : [];
@@ -15317,12 +15390,12 @@ function splitCommand(command) {
   return argv.length ? argv : new Error("empty command");
 }
 function checkRoot(cwd) {
-  return path16.resolve(git4(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+  return path17.resolve(git4(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
 }
 function detectedChecks(root) {
   const read = (file) => {
     try {
-      return fs12.readFileSync(path16.join(root, file), "utf8");
+      return fs13.readFileSync(path17.join(root, file), "utf8");
     } catch {
       return null;
     }
@@ -15361,7 +15434,7 @@ function detectedChecks(root) {
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = checksConfigFile(root);
-  const legacy = path16.basename(file) === LEGACY_CHECKS_FILE;
+  const legacy = path17.basename(file) === LEGACY_CHECKS_FILE;
   const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
   const note = legacy ? {
     note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
@@ -15376,7 +15449,7 @@ function loadCheckConfig(cwd) {
   });
   let text = null;
   try {
-    text = fs12.readFileSync(file, "utf8");
+    text = fs13.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
       return none(`cannot read ${label}: ${error.message}`);
@@ -15437,10 +15510,10 @@ function workitAvailable(env = process.env) {
     return workitOnPath;
   const windows = process.platform === "win32";
   const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  const dirs = (env.PATH ?? env.Path ?? "").split(path16.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path17.delimiter).filter(Boolean);
   workitOnPath = dirs.some((dir) => exts.some((ext) => {
     try {
-      return fs12.statSync(path16.join(dir, `workit${ext}`)).isFile();
+      return fs13.statSync(path17.join(dir, `workit${ext}`)).isFile();
     } catch {
       return false;
     }
@@ -15461,7 +15534,7 @@ var SCRIPT_CHECKS, CHECKS_FILE = ".workit/checks.json", LEGACY_CHECKS_FILE = "wo
   const value = run.status === 0 ? (run.stdout ?? "").trim() : "";
   return value || null;
 }, packageManager = (root) => {
-  const has = (file) => fs12.existsSync(path16.join(root, file));
+  const has = (file) => fs13.existsSync(path17.join(root, file));
   if (has("bun.lock") || has("bun.lockb"))
     return "bun";
   if (has("pnpm-lock.yaml"))
@@ -15484,14 +15557,14 @@ var init_check_config = __esm(() => {
 });
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash11 } from "node:crypto";
-import * as fs13 from "node:fs";
+import { createHash as createHash12 } from "node:crypto";
+import * as fs14 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path17 from "node:path";
+import path18 from "node:path";
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs13.realpathSync(root);
+    checkout = fs14.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -15509,11 +15582,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs13.existsSync(target))
+    if (!fs14.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs13.lstatSync(target);
+      stat = fs14.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -15529,17 +15602,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path17.join(checkout, item);
+    const target = path18.join(checkout, item);
     try {
-      const stat = fs13.lstatSync(target);
+      const stat = fs14.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs13.readlinkSync(target);
+        const link = fs14.readlinkSync(target);
         files.push({ path: item, kind: "symlink", digest: digestBytes(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes(fs13.readFileSync(target)),
+          digest: digestBytes(fs14.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -15938,12 +16011,12 @@ function boundTaskSummary(summary) {
   brief.truncated = JSON.stringify(brief).includes("…") || progress.blockers.length > BRIEF_BLOCKERS || unmet.length > BRIEF_OPEN;
   return brief;
 }
-var digestBytes = (value) => createHash11("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`), relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".", canonicalPath = (value) => {
+var digestBytes = (value) => createHash12("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path18.sep}`), relative = (root, candidate) => path18.relative(root, candidate).split(path18.sep).join("/") || ".", canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path17.posix.normalize(value);
+  const normalized = path18.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -15985,20 +16058,20 @@ var digestBytes = (value) => createHash11("sha256").update(value).digest("hex"),
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path18.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path18.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 }, walk = (root, directory, output) => {
   let names;
   try {
-    names = fs13.readdirSync(directory);
+    names = fs14.readdirSync(directory);
   } catch {
     return true;
   }
@@ -16006,10 +16079,10 @@ var digestBytes = (value) => createHash11("sha256").update(value).digest("hex"),
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path17.join(directory, name);
+    const target = path18.join(directory, name);
     let stat;
     try {
-      stat = fs13.lstatSync(target);
+      stat = fs14.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -16023,14 +16096,14 @@ var digestBytes = (value) => createHash11("sha256").update(value).digest("hex"),
 }, scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path17.resolve(root, item);
+    const target = path18.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs13.existsSync(ancestor) && ancestor !== root)
-      ancestor = path17.dirname(ancestor);
+    while (!fs14.existsSync(ancestor) && ancestor !== root)
+      ancestor = path18.dirname(ancestor);
     try {
-      if (!inside(root, fs13.realpathSync(ancestor)))
+      if (!inside(root, fs14.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -16083,7 +16156,7 @@ var digestBytes = (value) => createHash11("sha256").update(value).digest("hex"),
 }, findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId != null), verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
-    root = fs13.realpathSync(checkoutRoot);
+    root = fs14.realpathSync(checkoutRoot);
   } catch {
     return failure2("permission_denied", "checkout root is unavailable");
   }
@@ -16092,23 +16165,23 @@ var digestBytes = (value) => createHash11("sha256").update(value).digest("hex"),
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path17.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path17.sep}`))
+    const target = path18.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path18.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path17.relative(root, target);
+      const below = path18.relative(root, target);
       let current = root;
-      for (const segment of below.split(path17.sep)) {
+      for (const segment of below.split(path18.sep)) {
         if (!segment)
           continue;
-        current = path17.join(current, segment);
-        const stat = fs13.lstatSync(current);
-        const real = fs13.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path17.sep}`))
+        current = path18.join(current, segment);
+        const stat = fs14.lstatSync(current);
+        const real = fs14.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path18.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -16124,7 +16197,7 @@ var digestBytes = (value) => createHash11("sha256").update(value).digest("hex"),
         if (current !== target && !stat.isDirectory())
           return failure2("invalid_input", "document reference ancestor is not a directory");
       }
-      if (digestBytes(fs13.readFileSync(target)) !== reference.digest)
+      if (digestBytes(fs14.readFileSync(target)) !== reference.digest)
         return failure2("permission_denied", "decision document bytes have changed");
     } catch {
       return failure2("invalid_input", "decision document is unavailable");
@@ -18104,9 +18177,9 @@ var support = (descriptor, axis) => {
 });
 
 // packages/workit-core/src/hooks/context.ts
-import { createHash as createHash12 } from "node:crypto";
-import fs14 from "node:fs";
-import path18 from "node:path";
+import { createHash as createHash13 } from "node:crypto";
+import fs15 from "node:fs";
+import path19 from "node:path";
 function sessionCompactContext(store, session, context, selection = "session-bound") {
   const listed = store.listTaskIndex();
   if (!listed.ok)
@@ -18141,7 +18214,7 @@ function entryCompactContext(store, entry, session, context) {
     return null;
   const freshness = { mode: "signal", current: () => recentSignal(store.root) };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
-  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path18.resolve(store.root, ref.path)] : []));
+  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path19.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
   const compact = new WorkitCore(store, context).compactContext(entry?.id ?? null, freshness, origin && { origin: origin.origin, taskId: origin.entry.id });
   if (!compact.ok || !compact.data)
@@ -18239,7 +18312,7 @@ ${options.addendum}` : ""}
   } catch {
     return null;
   }
-}, TURN_TTL_MS, digestOf = (text) => createHash12("sha256").update(text).digest("hex"), turnMarker = (input) => {
+}, TURN_TTL_MS, digestOf = (text) => createHash13("sha256").update(text).digest("hex"), turnMarker = (input) => {
   if (!input.session.id)
     return null;
   try {
@@ -18247,29 +18320,29 @@ ${options.addendum}` : ""}
     if (location instanceof Error)
       return null;
     const session = [input.host, input.session.id, input.session.agentId ?? ""].join("\x00");
-    return path18.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
+    return path19.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
   } catch {
     return null;
   }
 }, writeTurnDigest = (file, digest) => {
   try {
-    fs14.mkdirSync(path18.dirname(file), { recursive: true });
-    fs14.writeFileSync(file, `${JSON.stringify({ digest })}
+    fs15.mkdirSync(path19.dirname(file), { recursive: true });
+    fs15.writeFileSync(file, `${JSON.stringify({ digest })}
 `);
   } catch {}
 }, clearTurnDigest = (file) => {
   try {
-    fs14.rmSync(file, { force: true });
+    fs15.rmSync(file, { force: true });
   } catch {}
 }, pruneTurnDigests = (dir, now) => {
   try {
-    for (const name of fs14.readdirSync(dir)) {
+    for (const name of fs15.readdirSync(dir)) {
       if (!name.startsWith("turn-"))
         continue;
-      const file = path18.join(dir, name);
+      const file = path19.join(dir, name);
       try {
-        if (now - fs14.statSync(file).mtimeMs > TURN_TTL_MS)
-          fs14.rmSync(file, { force: true });
+        if (now - fs15.statSync(file).mtimeMs > TURN_TTL_MS)
+          fs15.rmSync(file, { force: true });
       } catch {}
     }
   } catch {}
@@ -18284,7 +18357,7 @@ ${options.addendum}` : ""}
     return text;
   const digest = digestOf(text);
   try {
-    const previous = JSON.parse(fs14.readFileSync(file, "utf8"));
+    const previous = JSON.parse(fs15.readFileSync(file, "utf8"));
     if (previous.digest === digest)
       return null;
   } catch {}
@@ -18294,7 +18367,7 @@ ${options.addendum}` : ""}
   const file = turnMarker(input);
   if (!file)
     return;
-  pruneTurnDigests(path18.dirname(file), Date.now());
+  pruneTurnDigests(path19.dirname(file), Date.now());
   if (text)
     writeTurnDigest(file, digestOf(text));
   else
@@ -18314,9 +18387,9 @@ var init_context = __esm(() => {
 });
 
 // packages/workit-core/src/hooks/session-marker.ts
-import { createHash as createHash13 } from "node:crypto";
-import fs15 from "node:fs";
-import path19 from "node:path";
+import { createHash as createHash14 } from "node:crypto";
+import fs16 from "node:fs";
+import path20 from "node:path";
 var sessionMarkerFile = (input, session, store) => {
   let dir = store;
   if (dir === undefined) {
@@ -18325,19 +18398,19 @@ var sessionMarkerFile = (input, session, store) => {
       return null;
     dir = location.dir;
   }
-  const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
-  return path19.join(dir, "hooks", `skills-${name}.json`);
+  const name = createHash14("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
+  return path20.join(dir, "hooks", `skills-${name}.json`);
 }, list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [], readSessionMarker = (file) => {
   try {
-    const value = JSON.parse(fs15.readFileSync(file, "utf8"));
+    const value = JSON.parse(fs16.readFileSync(file, "utf8"));
     return { nudged: list2(value.nudged), loaded: list2(value.loaded), raw: list2(value.raw) };
   } catch {
     return { nudged: [], loaded: [], raw: [] };
   }
 }, writeSessionMarker = (file, marker) => {
   try {
-    fs15.mkdirSync(path19.dirname(file), { recursive: true });
-    fs15.writeFileSync(file, JSON.stringify(marker));
+    fs16.mkdirSync(path20.dirname(file), { recursive: true });
+    fs16.writeFileSync(file, JSON.stringify(marker));
   } catch {}
 };
 var init_session_marker = __esm(() => {
@@ -18772,10 +18845,10 @@ var init_shell_words = __esm(() => {
 
 // packages/workit-core/src/hooks/raw-git.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
-import { createHash as createHash14 } from "node:crypto";
-import fs16 from "node:fs";
+import { createHash as createHash15 } from "node:crypto";
+import fs17 from "node:fs";
 import os5 from "node:os";
-import path20 from "node:path";
+import path21 from "node:path";
 function rawInvocations(command, dialect = "posix", depth = 0) {
   if (depth > 0)
     return walk2(command, dialect, depth);
@@ -19057,8 +19130,8 @@ function noteRawCommit(input, command, key) {
       if (action.kind !== "commit")
         continue;
       const file = markerFile(repo, input.session.id, key);
-      fs16.mkdirSync(path20.dirname(file), { recursive: true });
-      fs16.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
+      fs17.mkdirSync(path21.dirname(file), { recursive: true });
+      fs17.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
 `);
     }
   } catch {}
@@ -19080,16 +19153,16 @@ function settlePendingCommit(input) {
     if (!repo)
       return;
     const file = markerFile(repo, input.session.id, NEXT_COMMAND);
-    if (fs16.existsSync(file))
+    if (fs17.existsSync(file))
       settle2(input, repo, file);
   } catch {}
 }
-var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLARATIONS, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, GIT_CONFIG_OPTIONS, GIT_CONFIG_ENV, ASSIGNMENT, MAX_DEPTH = 4, MAX_EXPANSIONS = 16, isAbsolute = (value) => path20.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\"), HERE, joinDir = (base, raw) => {
+var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLARATIONS, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, GIT_CONFIG_OPTIONS, GIT_CONFIG_ENV, ASSIGNMENT, MAX_DEPTH = 4, MAX_EXPANSIONS = 16, isAbsolute = (value) => path21.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\"), HERE, joinDir = (base, raw) => {
   const next = raw.replace(HERE, ".");
   if (base === undefined || /[$`*?]/.test(next) || next === "-")
     return;
-  const expanded = next === "~" || next.startsWith("~/") ? path20.join(os5.homedir(), next.slice(1)) : next;
-  return base === null || isAbsolute(expanded) ? expanded : path20.join(base, expanded);
+  const expanded = next === "~" || next.startsWith("~/") ? path21.join(os5.homedir(), next.slice(1)) : next;
+  return base === null || isAbsolute(expanded) ? expanded : path21.join(base, expanded);
 }, rebase = (base, inner) => inner === null ? base : inner === undefined ? undefined : joinDir(base, inner), cdTarget = (words) => {
   const args = words.slice(1);
   const flag = args.findIndex((word) => /^-(?:literal)?path$/i.test(word));
@@ -19558,7 +19631,7 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
     return null;
   return { location, dir, branch: resolveTaskKey(dir, location).branch };
 }, isWorkitWorkspace = (repo) => {
-  if (fs16.existsSync(repo.location.dir))
+  if (fs17.existsSync(repo.location.dir))
     return true;
   try {
     return resolveRuntimeWorkspaceVcs(repo.location.top ?? repo.dir) !== null;
@@ -19577,17 +19650,17 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
   if (!git || git.reftable)
     return null;
   try {
-    const head = fs16.readFileSync(path20.join(git.gitDir, "HEAD"), "utf8").trim();
+    const head = fs17.readFileSync(path21.join(git.gitDir, "HEAD"), "utf8").trim();
     if (/^[0-9a-f]{40,64}$/.test(head))
       return head;
     const ref = /^ref: (refs\/.+)$/.exec(head)?.[1];
     if (!ref)
       return null;
-    const common = path20.dirname(repo.location.dir);
+    const common = path21.dirname(repo.location.dir);
     try {
-      return fs16.readFileSync(path20.join(common, ref), "utf8").trim() || null;
+      return fs17.readFileSync(path21.join(common, ref), "utf8").trim() || null;
     } catch {}
-    const packed = fs16.readFileSync(path20.join(common, "packed-refs"), "utf8");
+    const packed = fs17.readFileSync(path21.join(common, "packed-refs"), "utf8");
     return new RegExp(`^([0-9a-f]{40,64}) ${ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m").exec(packed)?.[1] ?? null;
   } catch {
     return null;
@@ -19653,8 +19726,8 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
   const sub = invocation.args[0];
   if (invocation.tool !== "git" || invocation.dir === undefined || !sub || sub.startsWith("-") || GIT_COMMANDS.has(sub) || depth >= MAX_DEPTH)
     return [invocation];
-  const dir = path20.resolve(root, invocation.dir ?? ".");
-  if (!fs16.existsSync(dir))
+  const dir = path21.resolve(root, invocation.dir ?? ".");
+  if (!fs17.existsSync(dir))
     return [invocation];
   const config = gitConfig(dir, invocation, cache);
   const alias = configValue(config, `alias.${sub.toLowerCase()}`);
@@ -19675,11 +19748,11 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
 }, normalizedUrl = (url, dir) => {
   const trimmed = url.trim();
   if (/^file:\/\//i.test(trimmed))
-    return path20.resolve(dir, trimmed.slice(7)).replace(/\/+$/, "").replace(/\.git$/, "");
+    return path21.resolve(dir, trimmed.slice(7)).replace(/\/+$/, "").replace(/\.git$/, "");
   const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(trimmed);
   const scp = !scheme && /^(?:[^@/\\]+@)?[^/\\:]{2,}:/.test(trimmed);
   if (!scheme && !scp)
-    return path20.resolve(dir, trimmed).replace(/\/+$/, "").replace(/\.git$/, "");
+    return path21.resolve(dir, trimmed).replace(/\/+$/, "").replace(/\.git$/, "");
   const value = scheme ? trimmed.slice(scheme[0].length).replace(/^[^@/]*@/, "").replace(/^([^/:]+):\d+(?=\/)/, "$1") : trimmed.replace(/^[^@/]*@/, "").replace(":", "/");
   return value.toLowerCase().replace(/\/{2,}/g, "/").replace(/^www\./, "").replace(/\/+$/, "").replace(/\.git$/, "");
 }, rewrittenUrl = (url, config) => {
@@ -19885,7 +19958,7 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
   const out = [];
   const repos = new Map;
   const repoFor = (relative) => {
-    const dir = path20.resolve(cwd, relative ?? ".");
+    const dir = path21.resolve(cwd, relative ?? ".");
     if (!repos.has(dir)) {
       const repo = repoAt(dir);
       repos.set(dir, repo && isWorkitWorkspace(repo) ? repo : null);
@@ -19929,7 +20002,7 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
   kind: "deny",
   reason: `workit: the shell hook could not analyze this command (${error.message}), so it does not run. ${SPLIT_IT}`,
   unblock: SPLIT_IT
-}), NEXT_COMMAND = "next", MARKER_TTL_SECONDS = 3600, markerFile = (repo, session, key) => path20.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`), callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash14("sha256").update(command).digest("hex")}`, headCommit = (dir) => {
+}), NEXT_COMMAND = "next", MARKER_TTL_SECONDS = 3600, markerFile = (repo, session, key) => path21.join(repo.location.dir, "hooks", `commit-${createHash15("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`), callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash15("sha256").update(command).digest("hex")}`, headCommit = (dir) => {
   const run = spawnSync11("git", [
     "log",
     "-1",
@@ -19946,11 +20019,11 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
 }, settle2 = (input, repo, file) => {
   let marker;
   try {
-    marker = JSON.parse(fs16.readFileSync(file, "utf8"));
+    marker = JSON.parse(fs17.readFileSync(file, "utf8"));
   } catch {
     return;
   }
-  fs16.rmSync(file, { force: true });
+  fs17.rmSync(file, { force: true });
   const session = input.session.id;
   const now = Date.now() / 1000;
   if (typeof marker.at !== "number" || now - marker.at > MARKER_TTL_SECONDS)
@@ -20128,7 +20201,7 @@ var init_raw_git = __esm(() => {
 // packages/workit-core/src/core/route-intent.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
 import { existsSync as existsSync6 } from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 var UNKNOWABLE, SWITCH_CREATE, CHECKOUT_CREATE, WORKTREE_CREATE, SUBTREE_CREATE, BRANCH_NO_CREATE, BRANCH_RENAME, longOption = (name, flags) => flags.has(name) || name.length >= 3 && [...flags].some((flag) => flag.startsWith("--") && flag.startsWith(name)), shortsOf = (flags) => [...flags].filter((flag) => /^-[^-]$/u.test(flag)).join("").replaceAll("-", ""), flagValue = (args, flags) => {
   const shorts = shortsOf(flags);
   for (let index = 1;index < args.length; index++) {
@@ -20254,7 +20327,7 @@ var UNKNOWABLE, SWITCH_CREATE, CHECKOUT_CREATE, WORKTREE_CREATE, SUBTREE_CREATE,
     return null;
   if (dir === null)
     return root;
-  const resolved = path21.resolve(root, dir);
+  const resolved = path22.resolve(root, dir);
   return existsSync6(resolved) && inWorkitWorkspace(resolved) ? resolved : null;
 }, shellBranchPolicyViolation = (root, command, dialect = "posix") => {
   let judged = false;
@@ -20307,9 +20380,9 @@ var init_policy = __esm(() => {
 });
 
 // packages/workit-core/src/core/heavy-rules.ts
-import fs17 from "node:fs";
+import fs18 from "node:fs";
 import os6 from "node:os";
-import path22 from "node:path";
+import path23 from "node:path";
 function parseJsonc(text) {
   let out = "";
   for (let index = 0;index < text.length; index += 1) {
@@ -20339,21 +20412,21 @@ function parseJsonc(text) {
   return JSON.parse(out.replace(/,(\s*[}\]])/gu, "$1"));
 }
 function gitTop(cwd) {
-  for (let dir = path22.resolve(cwd);; dir = path22.dirname(dir)) {
-    if (fs17.existsSync(path22.join(dir, ".git")))
+  for (let dir = path23.resolve(cwd);; dir = path23.dirname(dir)) {
+    if (fs18.existsSync(path23.join(dir, ".git")))
       return dir;
-    if (path22.dirname(dir) === dir)
+    if (path23.dirname(dir) === dir)
       return null;
   }
 }
 function claudeSettingsFiles(cwd, env, platform = process.platform) {
   const project = env.CLAUDE_PROJECT_DIR || gitTop(cwd) || cwd;
-  const user = env.CLAUDE_CONFIG_DIR || path22.join(homeOf(env), ".claude");
+  const user = env.CLAUDE_CONFIG_DIR || path23.join(homeOf(env), ".claude");
   return [
     ...CLAUDE_MANAGED[platform] ? [CLAUDE_MANAGED[platform]] : [],
-    path22.join(user, "settings.json"),
-    path22.join(project, ".claude", "settings.json"),
-    path22.join(project, ".claude", "settings.local.json")
+    path23.join(user, "settings.json"),
+    path23.join(project, ".claude", "settings.json"),
+    path23.join(project, ".claude", "settings.local.json")
   ];
 }
 function claudeRules(cwd, env = process.env) {
@@ -20398,10 +20471,10 @@ function claudeRules(cwd, env = process.env) {
 function opencodeRules(cwd, env = process.env) {
   const rules = EMPTY();
   try {
-    const config = env.XDG_CONFIG_HOME || path22.join(homeOf(env), ".config");
+    const config = env.XDG_CONFIG_HOME || path23.join(homeOf(env), ".config");
     const files = [
-      ...OPENCODE_NAMES.map((name) => path22.join(config, "opencode", name)),
-      ...projectDirs(cwd).flatMap((dir) => OPENCODE_NAMES.flatMap((name) => [path22.join(dir, name), path22.join(dir, ".opencode", name)])),
+      ...OPENCODE_NAMES.map((name) => path23.join(config, "opencode", name)),
+      ...projectDirs(cwd).flatMap((dir) => OPENCODE_NAMES.flatMap((name) => [path23.join(dir, name), path23.join(dir, ".opencode", name)])),
       ...env.OPENCODE_CONFIG ? [env.OPENCODE_CONFIG] : []
     ];
     for (const file of files) {
@@ -20419,19 +20492,19 @@ function opencodeRules(cwd, env = process.env) {
 function codexRules(cwd, env = process.env) {
   const rules = EMPTY();
   try {
-    const home = env.CODEX_HOME || path22.join(homeOf(env), ".codex");
+    const home = env.CODEX_HOME || path23.join(homeOf(env), ".codex");
     const top = gitTop(cwd) ?? cwd;
-    for (const dir of [path22.join(home, "rules"), path22.join(top, ".codex", "rules")]) {
+    for (const dir of [path23.join(home, "rules"), path23.join(top, ".codex", "rules")]) {
       let files;
       try {
-        files = fs17.readdirSync(dir).filter((name) => name.endsWith(".rules"));
+        files = fs18.readdirSync(dir).filter((name) => name.endsWith(".rules"));
       } catch (error) {
         if (error.code === "ENOENT")
           continue;
         return "unreadable";
       }
       for (const name of files) {
-        const text = readText2(path22.join(dir, name)) ?? "";
+        const text = readText2(path23.join(dir, name)) ?? "";
         for (const part of text.split(/\bprefix_rule\s*\(/u).slice(1)) {
           const rule = codexRule(part);
           if (!rule)
@@ -20450,8 +20523,8 @@ function cursorRules(cwd, env = process.env) {
   try {
     const top = gitTop(cwd) ?? cwd;
     for (const file of [
-      path22.join(homeOf(env), ".cursor", "cli-config.json"),
-      path22.join(top, ".cursor", "cli.json")
+      path23.join(homeOf(env), ".cursor", "cli-config.json"),
+      path23.join(top, ".cursor", "cli.json")
     ]) {
       const text = readText2(file);
       if (text === null)
@@ -20504,7 +20577,7 @@ function wrapAllowed(read, words, command, options = {}) {
 }
 var EMPTY = () => ({ deny: [], allow: [] }), readText2 = (file) => {
   try {
-    return fs17.readFileSync(file, "utf8");
+    return fs18.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -20513,9 +20586,9 @@ var EMPTY = () => ({ deny: [], allow: [] }), readText2 = (file) => {
 }, isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), projectDirs = (cwd) => {
   const top = gitTop(cwd);
   const dirs = [];
-  for (let dir = path22.resolve(cwd);; dir = path22.dirname(dir)) {
+  for (let dir = path23.resolve(cwd);; dir = path23.dirname(dir)) {
     dirs.push(dir);
-    if (!top || dir === top || path22.dirname(dir) === dir)
+    if (!top || dir === top || path23.dirname(dir) === dir)
       return dirs;
   }
 }, homeOf = (env) => env.HOME || os6.homedir(), CLAUDE_MANAGED, bashPattern = (entry) => {
@@ -20611,20 +20684,20 @@ var init_heavy_rules = __esm(() => {
 });
 
 // packages/workit-core/src/core/heavy.ts
-import fs18 from "node:fs";
+import fs19 from "node:fs";
 import os7 from "node:os";
-import path23 from "node:path";
+import path24 from "node:path";
 function stateDir(env, platform = process.platform) {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path23.join(env.XDG_STATE_HOME, "workit");
+    return path24.join(env.XDG_STATE_HOME, "workit");
   const home = env.HOME || os7.homedir();
   if (platform === "darwin")
-    return path23.join(home, "Library", "Application Support", "workit");
+    return path24.join(home, "Library", "Application Support", "workit");
   if (platform === "win32")
-    return path23.join(env.LOCALAPPDATA ?? path23.join(home, "AppData", "Local"), "workit");
-  return path23.join(home, ".local", "state", "workit");
+    return path24.join(env.LOCALAPPDATA ?? path24.join(home, "AppData", "Local"), "workit");
+  return path24.join(home, ".local", "state", "workit");
 }
 function positional2(words, from, values = PM_VALUES) {
   let index = from;
@@ -20764,7 +20837,7 @@ function machinePatterns(env) {
   return isRecord5(value) ? stringList(value.patterns) : [];
 }
 function repoPatterns(cwd) {
-  return repoHeavyCommands(gitTop(cwd) ?? path23.resolve(cwd));
+  return repoHeavyCommands(gitTop(cwd) ?? path24.resolve(cwd));
 }
 function heavyLines(lines, options) {
   const found = [];
@@ -20833,12 +20906,12 @@ function heavyPlan(command, options) {
 }
 function workitOnPath2(env = process.env) {
   const names = process.platform === "win32" ? ["workit.exe", "workit.cmd", "workit"] : ["workit"];
-  for (const dir of (env.PATH ?? "").split(path23.delimiter))
+  for (const dir of (env.PATH ?? "").split(path24.delimiter))
     for (const name of names) {
       if (!dir)
         continue;
       try {
-        fs18.accessSync(path23.join(dir, name), fs18.constants.X_OK);
+        fs19.accessSync(path24.join(dir, name), fs19.constants.X_OK);
         return true;
       } catch {}
     }
@@ -20852,9 +20925,9 @@ function leaseRewrite(command) {
     return null;
   return `${prefix}workit check --heavy -- ${rest}`;
 }
-var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path23.join(stateDir(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson = (file) => {
+var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path24.join(stateDir(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson = (file) => {
   try {
-    return JSON.parse(fs18.readFileSync(file, "utf8"));
+    return JSON.parse(fs19.readFileSync(file, "utf8"));
   } catch {
     return;
   }
@@ -20996,9 +21069,9 @@ var init_heavy = __esm(() => {
 });
 
 // packages/workit-core/src/core/heavy-words.ts
-import fs19 from "node:fs";
+import fs20 from "node:fs";
 import os8 from "node:os";
-import path24 from "node:path";
+import path25 from "node:path";
 function maybeHeavy(command, cwd, env = process.env) {
   try {
     const words = wordsOf(command);
@@ -21014,30 +21087,30 @@ var HEAVY_WORDS, wordsOf = (command) => command.split(/[\s;&|()<>`'"]+/u).map((w
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path24.join(env.XDG_STATE_HOME, "workit");
+    return path25.join(env.XDG_STATE_HOME, "workit");
   const home = env.HOME || os8.homedir();
   if (process.platform === "darwin")
-    return path24.join(home, "Library", "Application Support", "workit");
+    return path25.join(home, "Library", "Application Support", "workit");
   if (process.platform === "win32")
-    return path24.join(env.LOCALAPPDATA ?? path24.join(home, "AppData", "Local"), "workit");
-  return path24.join(home, ".local", "state", "workit");
+    return path25.join(env.LOCALAPPDATA ?? path25.join(home, "AppData", "Local"), "workit");
+  return path25.join(home, ".local", "state", "workit");
 }, readJson2 = (file) => {
   try {
-    return JSON.parse(fs19.readFileSync(file, "utf8"));
+    return JSON.parse(fs20.readFileSync(file, "utf8"));
   } catch {
     return;
   }
 }, patternWords = (cwd, env) => {
   const patterns = [];
-  const machine = readJson2(path24.join(stateDir2(env), "heavy-commands.json"));
+  const machine = readJson2(path25.join(stateDir2(env), "heavy-commands.json"));
   if (Array.isArray(machine?.patterns))
     patterns.push(...machine.patterns);
-  for (let dir = path24.resolve(cwd);; dir = path24.dirname(dir)) {
-    if (fs19.existsSync(path24.join(dir, ".git"))) {
+  for (let dir = path25.resolve(cwd);; dir = path25.dirname(dir)) {
+    if (fs20.existsSync(path25.join(dir, ".git"))) {
       patterns.push(...repoHeavyCommands(dir));
       break;
     }
-    if (path24.dirname(dir) === dir)
+    if (path25.dirname(dir) === dir)
       break;
   }
   const words = new Set;
@@ -21104,10 +21177,10 @@ var init_heavy_gate = __esm(() => {
 
 // packages/workit-core/src/core/live-session.ts
 import { spawnSync as spawnSync13 } from "node:child_process";
-import { createHash as createHash15 } from "node:crypto";
-import fs20 from "node:fs";
+import { createHash as createHash16 } from "node:crypto";
+import fs21 from "node:fs";
 import os9 from "node:os";
-import path25 from "node:path";
+import path26 from "node:path";
 var LIVE_SESSION_TTL_MS, HEARTBEAT_EVERY_MS = 30000, liveProbe, leadOf = (session) => session.split(":")[0].replace(/-w-.*$/su, "") || session, familyOf = (host) => host.replace(/_(?:cli|desktop)$/u, ""), processAlive = (pid) => {
   try {
     process.kill(pid, 0);
@@ -21118,9 +21191,9 @@ var LIVE_SESSION_TTL_MS, HEARTBEAT_EVERY_MS = 30000, liveProbe, leadOf = (sessio
 }, processInfo = (pid) => {
   try {
     if (liveProbe.platform === "linux") {
-      const stat = fs20.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const stat = fs21.readFileSync(`/proc/${pid}/stat`, "utf8");
       const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
-      const command = fs20.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
+      const command = fs21.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
       return Number.isInteger(ppid) ? { ppid, command: command.trim() } : null;
     }
     if (liveProbe.platform === "win32")
@@ -21165,32 +21238,32 @@ var LIVE_SESSION_TTL_MS, HEARTBEAT_EVERY_MS = 30000, liveProbe, leadOf = (sessio
     pid: () => hostPid(transport)
   };
 }, checkoutOf = (target) => {
-  let dir = path25.resolve(target);
-  while (!fs20.existsSync(dir) && path25.dirname(dir) !== dir)
-    dir = path25.dirname(dir);
-  if (fs20.existsSync(dir) && !fs20.statSync(dir).isDirectory())
-    dir = path25.dirname(dir);
-  const parts = dir.split(path25.sep);
+  let dir = path26.resolve(target);
+  while (!fs21.existsSync(dir) && path26.dirname(dir) !== dir)
+    dir = path26.dirname(dir);
+  if (fs21.existsSync(dir) && !fs21.statSync(dir).isDirectory())
+    dir = path26.dirname(dir);
+  const parts = dir.split(path26.sep);
   const dotGit = parts.lastIndexOf(".git");
   if (dotGit > 0)
-    dir = parts.slice(0, dotGit).join(path25.sep) || path25.sep;
+    dir = parts.slice(0, dotGit).join(path26.sep) || path26.sep;
   const location = resolveStore(dir);
   if (location instanceof Error || !location.shared || !location.top)
     return null;
   let top = location.top;
   try {
-    top = fs20.realpathSync.native(top);
+    top = fs21.realpathSync.native(top);
   } catch {}
   return top;
-}, markerFile2 = (top) => path25.join(resolveStateDir(), "live-sessions", `${createHash15("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`), checkoutKey = (top, platform = process.platform) => {
-  let key = path25.resolve(top);
+}, markerFile2 = (top) => path26.join(resolveStateDir(), "live-sessions", `${createHash16("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`), checkoutKey = (top, platform = process.platform) => {
+  let key = path26.resolve(top);
   try {
-    key = fs20.realpathSync.native(key);
+    key = fs21.realpathSync.native(key);
   } catch {}
   return platform === "win32" ? key.replaceAll("/", "\\").toLowerCase() : key;
 }, readMarker = (file) => {
   try {
-    const value = JSON.parse(fs20.readFileSync(file, "utf8"));
+    const value = JSON.parse(fs21.readFileSync(file, "utf8"));
     if (value?.version !== 1 || typeof value.session !== "string" || typeof value.host !== "string" || typeof value.heartbeatAt !== "string" || Number.isNaN(Date.parse(value.heartbeatAt)))
       return null;
     return {
@@ -21271,10 +21344,10 @@ var LIVE_SESSION_TTL_MS, HEARTBEAT_EVERY_MS = 30000, liveProbe, leadOf = (sessio
       checkout,
       heartbeatAt: now.toISOString()
     };
-    fs20.mkdirSync(path25.dirname(file), { recursive: true });
+    fs21.mkdirSync(path26.dirname(file), { recursive: true });
     const temp = `${file}.${process.pid}.tmp`;
-    fs20.writeFileSync(temp, JSON.stringify(marker));
-    fs20.renameSync(temp, file);
+    fs21.writeFileSync(temp, JSON.stringify(marker));
+    fs21.renameSync(temp, file);
   } catch {}
 };
 var init_live_session = __esm(() => {
@@ -21294,7 +21367,7 @@ var init_live_session = __esm(() => {
 // packages/workit-core/src/hooks/write-gate.ts
 import { realpathSync as realpathSync5 } from "node:fs";
 import os10 from "node:os";
-import path26 from "node:path";
+import path27 from "node:path";
 function writeGate(cwd, paths, owner, deps) {
   const forged = paths?.length ? issuedTarget(cwd, paths) : null;
   if (forged)
@@ -21322,7 +21395,7 @@ function shellGate(cwd, command, owner, dialect = "posix", deps) {
     try {
       targets = [
         ...segmentTargets(cwd, command, dialect),
-        ...gitMutationDirs(cwd, command, dialect).map((dir) => path26.join(dir, DIR_TARGET))
+        ...gitMutationDirs(cwd, command, dialect).map((dir) => path27.join(dir, DIR_TARGET))
       ];
     } catch {
       targets = [];
@@ -21360,21 +21433,21 @@ function beforeWriteGate(cwd, paths) {
 }
 var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
   let rest = "";
-  for (let dir = path26.resolve(file);; dir = path26.dirname(dir)) {
+  for (let dir = path27.resolve(file);; dir = path27.dirname(dir)) {
     try {
-      return path26.join(realpathSync5.native(dir), rest);
+      return path27.join(realpathSync5.native(dir), rest);
     } catch {
-      if (path26.dirname(dir) === dir)
-        return path26.resolve(file);
-      rest = rest ? path26.join(path26.basename(dir), rest) : path26.basename(dir);
+      if (path27.dirname(dir) === dir)
+        return path27.resolve(file);
+      rest = rest ? path27.join(path27.basename(dir), rest) : path27.basename(dir);
     }
   }
 }, exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path26.relative(fold(canonical2(root)), fold(canonical2(path26.resolve(cwd, file))));
-  if (relative.startsWith("..") || path26.isAbsolute(relative))
+  const relative = path27.relative(fold(canonical2(root)), fold(canonical2(path27.resolve(cwd, file))));
+  if (relative.startsWith("..") || path27.isAbsolute(relative))
     return true;
-  const posix = relative.split(path26.sep).join("/");
+  const posix = relative.split(path27.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 }, PREFIXES2, operands = (words) => words.filter((item) => !item.startsWith("-")), SCRIPT_SHELLS, wrappedScript = (input) => {
@@ -21487,7 +21560,7 @@ var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
   if (!unknown && targets.length === 0)
     return { writes: false, targets: null };
   return { writes: true, targets: unknown ? null : targets };
-}, cache2, planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path26.resolve(root, file)) ?? "-").join("\x00"), gateFor = (cwd) => {
+}, cache2, planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path27.resolve(root, file)) ?? "-").join("\x00"), gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
   if (!listed.ok)
@@ -21540,14 +21613,14 @@ var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
       return [];
     if (sub === "stash" && ["list", "show"].includes(rest[0] ?? ""))
       return [];
-    return [path26.resolve(cwd, invocation.dir ?? ".")];
+    return [path27.resolve(cwd, invocation.dir ?? ".")];
   });
 }, CD2, PUSHD2, POPD2, cdInto = (dir, words) => {
   const named = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
   const target = named === undefined ? undefined : homeExpanded(named);
   if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
     return;
-  return target === undefined ? os10.homedir() : path26.resolve(dir, target);
+  return target === undefined ? os10.homedir() : path27.resolve(dir, target);
 }, quoteWord2 = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`, homeExpanded = (file) => {
   const match = /^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/.exec(file);
   return match ? (process.env.HOME || os10.homedir()) + file.slice(match[0].length) : file;
@@ -21558,7 +21631,7 @@ var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
   const groups = [];
   const at = (file) => {
     const home = homeExpanded(file);
-    return path26.isAbsolute(home) ? home : dir === undefined ? null : path26.resolve(dir, home);
+    return path27.isAbsolute(home) ? home : dir === undefined ? null : path27.resolve(dir, home);
   };
   for (const segment of segmentsOf(command, dialect)) {
     if (segment.group === "open") {
@@ -21599,7 +21672,7 @@ var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
     const edits = editsOf(segment.words);
     if (edits === null) {
       if (dir !== undefined)
-        targets.push(path26.join(dir, DIR_TARGET));
+        targets.push(path27.join(dir, DIR_TARGET));
     } else
       for (const file of edits) {
         const resolved = at(file);
@@ -21607,7 +21680,7 @@ var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
           targets.push(resolved);
       }
     if (dir !== undefined && workitInvocations(segment.words.map(quoteWord2).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
-      targets.push(path26.join(dir, DIR_TARGET));
+      targets.push(path27.join(dir, DIR_TARGET));
   }
   return targets;
 }, overridden = (command, dialect) => {
@@ -21630,7 +21703,7 @@ var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
 }, guarded = (targets) => {
   const seen = new Set;
   return targets.filter((target) => {
-    const dir = path26.dirname(target);
+    const dir = path27.dirname(target);
     if (seen.has(dir))
       return false;
     seen.add(dir);
@@ -21648,13 +21721,13 @@ var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
 }, claimAll = (owner, targets, deps) => {
   for (const target of guarded(targets))
     claimLiveSession(target, owner, deps);
-}, liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path26.resolve(cwd, file)) : [path26.join(cwd, DIR_TARGET)], issuedTarget = (cwd, targets) => {
+}, liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path27.resolve(cwd, file)) : [path27.join(cwd, DIR_TARGET)], issuedTarget = (cwd, targets) => {
   const state = resolveStateDir();
   const found = targets.find((target) => underIssued(state, cwd, homeExpanded(target), process.platform, canonical2));
   return found ?? null;
 }, underIssued = (state, cwd, target, platform = process.platform, real = (file) => file) => {
   const win = platform === "win32";
-  const p = win ? path26.win32 : path26.posix;
+  const p = win ? path27.win32 : path27.posix;
   const fold = (value) => win || platform === "darwin" ? value.toLowerCase() : value;
   const named = win ? target.replace(/^\/([a-zA-Z])(?=\/|$)/, "$1:") : target;
   const relative = p.relative(fold(real(p.resolve(state))), fold(real(p.resolve(cwd, named))));
@@ -22111,9 +22184,9 @@ var init_skill_nudge = __esm(() => {
 
 // packages/workit-core/src/hooks/hosts/fields.ts
 import { existsSync as existsSync7, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 var isRecord6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value), nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "", optionalText = (value) => typeof value === "string" ? value : null, existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path27.isAbsolute(value) || !existsSync7(value))
+  if (!nonEmpty2(value) || !path28.isAbsolute(value) || !existsSync7(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -22177,8 +22250,119 @@ var init_fields = __esm(() => {
   PATCH_HEADER = /^[ \t]*\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/gm;
 });
 
+// packages/workit-core/src/hooks/standing.ts
+import fs22 from "node:fs";
+import path29 from "node:path";
+var readPlans = (store) => {
+  const dir = path29.join(store, "fanouts");
+  let names;
+  try {
+    names = fs22.readdirSync(dir).filter((name) => name.endsWith(".json"));
+  } catch {
+    return [];
+  }
+  const plans = [];
+  for (const name of names) {
+    try {
+      const raw = JSON.parse(fs22.readFileSync(path29.join(dir, name), "utf8"));
+      if (typeof raw.name !== "string" || !Array.isArray(raw.slices))
+        continue;
+      const texts = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string" && item !== "") : [];
+      plans.push({
+        name: raw.name,
+        leads: texts([raw.leadSession, ...texts(raw.formerLeads)]),
+        branches: texts(raw.slices.map((slice) => slice && typeof slice === "object" ? slice.branch : null))
+      });
+    } catch {}
+  }
+  return plans;
+}, leadOf2 = (input) => input.session.parentId ?? (input.session.agentId ? input.session.id : null) ?? (input.session.id.includes(":") ? input.session.id.split(":")[0] : null), worksFor = (plan, input, branch) => {
+  const session = input.session.id;
+  if (plan.leads.includes(session) && !input.session.agentId)
+    return false;
+  const lead = leadOf2(input);
+  if (lead && plan.leads.includes(lead))
+    return true;
+  if (plan.leads.some((each) => session.startsWith(`${each}-w-`)))
+    return true;
+  const current = branch();
+  return current !== null && plan.branches.includes(current);
+}, standingFor = (input, store, rev) => {
+  const orders = new Map;
+  const ledger = readLedger(input.cwd);
+  const rows = ledger.ok ? ledger.value.rows : [];
+  let branch;
+  const lazyBranch = () => branch === undefined ? branch = currentBranch(input.cwd) : branch;
+  for (const plan of readPlans(store))
+    if (worksFor(plan, input, lazyBranch))
+      for (const row of activeStanding(rows, plan.name, plan.leads.length ? plan.leads : null))
+        orders.set(row.id, row);
+  return { rev, orders, rows };
+}, located = (input) => {
+  const store = input.session.id ? gitStoreDir(input.cwd) : null;
+  const rev = store ? readStandingRev(store) : null;
+  if (!store || rev === null)
+    return null;
+  return { store, rev, file: standingSeenFile(store, input.session.id, input.session.agentId) };
+}, seedStanding = (input) => {
+  try {
+    const where = located(input);
+    if (!where)
+      return;
+    const now = standingFor(input, where.store, where.rev);
+    writeStandingSeen(where.file, { rev: where.rev, ids: [...now.orders.keys()] });
+  } catch {}
+}, fanoutOf = (row) => typeof row.fanout === "string" ? row.fanout : "?", changedSince = (now, ids) => {
+  const known = new Set(ids);
+  const added = [...now.orders.values()].filter((row) => !known.has(row.id));
+  const byId = new Map(now.rows.map((row) => [row.id, row]));
+  const dropped = ids.filter((id) => !now.orders.has(id)).map((id) => byId.get(id)).filter((row) => row !== undefined);
+  if (!added.length && !dropped.length)
+    return null;
+  const fanouts = [...new Set([...added, ...dropped].map(fanoutOf))].join(", ");
+  const lines = [
+    `Workit: the lead changed the standing orders for fanout ${fanouts} while you run. They apply to you now and override your brief's STANDING list.`,
+    ...added.map((row) => `  - new: ${String(row.what)}`),
+    ...dropped.map((row) => `  - no longer in force: ${String(row.what)}${row.stop ? " (the stop is lifted: continue your brief)" : ""}`)
+  ];
+  if (added.some((row) => row.stop === true))
+    lines.push("Stop now: make no further changes, close what you opened, and report to the lead with your branch, head SHA, what is done and what is not.");
+  return lines.join(`
+`);
+}, standingDelta = (input) => {
+  try {
+    const where = located(input);
+    if (!where)
+      return null;
+    const seen = readStandingSeen(where.file);
+    if (seen.rev === where.rev)
+      return null;
+    const now = standingFor(input, where.store, where.rev);
+    writeStandingSeen(where.file, { rev: where.rev, ids: [...now.orders.keys()] });
+    return changedSince(now, seen.ids);
+  } catch {
+    return null;
+  }
+}, sinceStart;
+var init_standing = __esm(() => {
+  init_rev();
+  init_ledger();
+  init_standing_signal();
+  sinceStart = new Map;
+});
+
 // packages/workit-core/src/hooks/handle.ts
 function handleHook(input, deps) {
+  const decision = decide(input, deps);
+  if (deps.descriptor.transport !== "hook-process" || !PRE_TOOL.has(input.event.kind) || decision.kind === "deny")
+    return decision;
+  const delta = standingDelta(input);
+  if (!delta)
+    return decision;
+  return decision.kind === "rewrite" ? { ...decision, text: [decision.text, delta].filter(Boolean).join(`
+`) } : withContextLine(decision, delta);
+}
+function decide(input, deps) {
   const { descriptor } = deps;
   const event = input.event;
   switch (event.kind) {
@@ -22255,6 +22439,7 @@ function handleHook(input, deps) {
     case "write.pre":
       return usable2(descriptor.events["write.pre"].support) ? writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport)) : NONE5;
     case "subagent.start":
+      seedStanding({ ...input, session: { ...input.session, agentId: event.agentId } });
       return {
         kind: "context",
         text: subagentStartText(input, descriptor, event)
@@ -22304,7 +22489,7 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
   const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
   return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
-}, failureDecision = (descriptor, event, error) => {
+}, PRE_TOOL, failureDecision = (descriptor, event, error) => {
   if (event === "shell.pre" || event === "tool.pre" || event === "write.pre")
     return descriptor.shellPolicy.failClosed ? { kind: "deny", reason: error, unblock: null } : NONE5;
   if (event === "session.start" || event === "subagent.start")
@@ -22341,6 +22526,7 @@ var init_handle = __esm(() => {
   init_policy();
   init_raw_git();
   init_skill_nudge();
+  init_standing();
   init_stop();
   init_live_session();
   init_write_gate();
@@ -22352,18 +22538,19 @@ var init_handle = __esm(() => {
     reviewer: "judge"
   };
   CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
+  PRE_TOOL = new Set(["shell.pre", "write.pre", "tool.pre"]);
 });
 
 // packages/workit-core/src/hooks/deadline.ts
 import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
-import path28 from "node:path";
+import path30 from "node:path";
 var HOOK_SKIP_TEXT = "workit context skipped: host under load", HOOK_DEADLINE_MS = 8000, HOST_DEADLINES, HOOK_SKIPS_FILE = "hook-skips.jsonl", override = (env) => {
   const value = Number(env.WORKIT_HOOK_DEADLINE_MS);
   return Number.isFinite(value) && value > 0 ? value : null;
 }, hookDeadlineMs = (env, host = "", native) => {
   const row = HOST_DEADLINES[host];
   return override(env) ?? (row ? native === undefined ? Math.min(...Object.values(row)) : row[native] ?? row[""] : HOOK_DEADLINE_MS);
-}, skipsFile = (stateDir) => path28.join(stateDir, HOOK_SKIPS_FILE), recordHookSkip = (skip, stateDir = resolveStateDir()) => {
+}, skipsFile = (stateDir) => path30.join(stateDir, HOOK_SKIPS_FILE), recordHookSkip = (skip, stateDir = resolveStateDir()) => {
   try {
     mkdirSync3(stateDir, { recursive: true });
     appendFileSync(skipsFile(stateDir), `${JSON.stringify(skip)}
@@ -23007,8 +23194,8 @@ var init_codex = __esm(() => {
 });
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import fs21 from "node:fs";
-import path29 from "node:path";
+import fs23 from "node:fs";
+import path31 from "node:path";
 var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (value) => {
   if (!isRecord6(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
@@ -23089,17 +23276,17 @@ var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (valu
       };
   }
 }, TRANSCRIPT_TAIL_BYTES, lastAssistantText = (file) => {
-  if (!file || !path29.isAbsolute(file))
+  if (!file || !path31.isAbsolute(file))
     return null;
   try {
-    const size = fs21.statSync(file).size;
+    const size = fs23.statSync(file).size;
     const start = Math.max(0, size - TRANSCRIPT_TAIL_BYTES);
     const buffer = Buffer.alloc(size - start);
-    const fd = fs21.openSync(file, "r");
+    const fd = fs23.openSync(file, "r");
     try {
-      fs21.readSync(fd, buffer, 0, buffer.length, start);
+      fs23.readSync(fd, buffer, 0, buffer.length, start);
     } finally {
-      fs21.closeSync(fd);
+      fs23.closeSync(fd);
     }
     const lines = buffer.toString("utf8").split(`
 `);
@@ -23125,7 +23312,7 @@ var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (valu
   } catch {
     return null;
   }
-}, within2 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path29.sep) ? root : `${root}${path29.sep}`), hookCwd = (input) => {
+}, within2 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path31.sep) ? root : `${root}${path31.sep}`), hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
     return cwd;
@@ -23359,6 +23546,7 @@ var init_hooks = __esm(async () => {
   init_raw_git();
   init_skill_nudge();
   init_fields();
+  init_standing();
   init_handle();
   init_claude_code();
   init_codex();