npm - @brainervirus/workit-cursor - Versions diffs - 8.9.1 → 8.11.0 - Mend

@brainervirus/workit-cursor 8.9.1 → 8.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/.cursor-plugin/plugin.json +1 -1
package/dist/cursor-session-start.js +956 -643
package/dist/mcp-server.js +151 -134
package/dist/workit-hook.js +985 -648
package/package.json +3 -3
package/rules/workit-contract.mdc +4 -1
package/skills/workit-fanout/references/brief.md +1 -1
package/skills/workit-fanout/references/orchestration.md +16 -6
package/skills/workit-implement/SKILL.md +3 -2
package/skills/workit-review/SKILL.md +4 -2

package/dist/cursor-session-start.js CHANGED Viewed

@@ -8834,7 +8834,7 @@ var PREFIXES, branchNames = (workspaceRoot) => {
     return new Set;
   return new Set((r.stdout ?? "").split(`
 `).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
-}, detectBranchPolicy = (workspaceRoot) => {
+}, productionBranchOf = (names) => names.has("main") ? "main" : names.has("master") ? "master" : "main", detectBranchPolicy = (workspaceRoot) => {
   const names = branchNames(workspaceRoot);
   const develop = names.has("develop");
   const main = names.has("main");
@@ -9832,37 +9832,6 @@ var init_vcs_config = __esm(() => {
   init_release_tracks();
 });
-// packages/workit-core/src/host-session.ts
-function hostSessionFromEnv(env) {
-  const value = (key) => env[key]?.trim() || null;
-  let inner = null;
-  for (const [key, host] of HOST_SESSION_VARS) {
-    const session = value(key);
-    if (session) {
-      inner = { host: host(env), session };
-      break;
-    }
-  }
-  const declared = value("WORKIT_HOST");
-  if (env.WORKIT_SESSION_ID !== undefined) {
-    const inherited = inner !== null && declared !== null && family(declared) !== family(inner.host);
-    if (!inherited)
-      return { host: declared, session: value("WORKIT_SESSION_ID") };
-  }
-  return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
-}
-var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null;
-var init_host_session = __esm(() => {
-  HOST_SESSION_VARS = [
-    ["OPENCODE_SESSION_ID", () => "opencode"],
-    ["PI_SESSION_ID", () => "pi"],
-    [
-      "CODEX_THREAD_ID",
-      (env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
-    ]
-  ];
-});
 // packages/workit-core/src/store/paths.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
@@ -10139,11 +10108,69 @@ var init_paths = __esm(() => {
   ];
 });
-// packages/workit-core/src/ledger.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
-import { createHash as createHash6, randomBytes } from "node:crypto";
+// packages/workit-core/src/host-session.ts
+import { createHash as createHash6 } from "node:crypto";
 import fs4 from "node:fs";
 import path6 from "node:path";
+function hostSessionFromEnv(env) {
+  const value = (key) => env[key]?.trim() || null;
+  let inner = null;
+  for (const [key, host] of HOST_SESSION_VARS) {
+    const session = value(key);
+    if (session) {
+      inner = { host: host(env), session };
+      break;
+    }
+  }
+  const declared = value("WORKIT_HOST");
+  if (env.WORKIT_SESSION_ID !== undefined) {
+    const inherited = inner !== null && declared !== null && family(declared) !== family(inner.host);
+    if (!inherited)
+      return { host: declared, session: value("WORKIT_SESSION_ID") };
+  }
+  return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
+}
+function recordIssuedSession(cwd, lead, issued) {
+  try {
+    const dir = issuedDir(cwd, lead);
+    if (!dir)
+      return;
+    fs4.mkdirSync(dir, { recursive: true });
+    const own = hash(issued);
+    fs4.writeFileSync(path6.join(dir, own), ISSUED_SESSIONS_MARKER);
+    const entries = fs4.readdirSync(dir);
+    if (entries.length <= ISSUED_PER_LEAD)
+      return;
+    const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs4.statSync(path6.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
+    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD))
+      fs4.rmSync(path6.join(dir, name), { force: true });
+  } catch {}
+}
+var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, ISSUED_PER_LEAD = 64, ISSUED_SESSIONS_MARKER = "workit-issued-sessions/1", hash = (value) => createHash6("sha256").update(value).digest("hex").slice(0, 32), issuedRoot = (cwd) => {
+  const location = resolveStore(cwd);
+  return location instanceof Error ? null : path6.join(location.dir, "hooks", "issued");
+}, issuedDir = (cwd, lead) => {
+  const root = issuedRoot(cwd);
+  return root === null ? null : path6.join(root, hash(lead));
+}, OWN_CHILD_SHELL;
+var init_host_session = __esm(() => {
+  init_paths();
+  HOST_SESSION_VARS = [
+    ["OPENCODE_SESSION_ID", () => "opencode"],
+    ["PI_SESSION_ID", () => "pi"],
+    [
+      "CODEX_THREAD_ID",
+      (env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
+    ]
+  ];
+  OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
+});
+// packages/workit-core/src/ledger.ts
+import { spawnSync as spawnSync7 } from "node:child_process";
+import { createHash as createHash7, randomBytes } from "node:crypto";
+import fs5 from "node:fs";
+import path7 from "node:path";
 function resolveCommit(cwd, ref) {
   if (!safeRef(ref))
     return null;
@@ -10197,7 +10224,7 @@ function diffHash(cwd, base, head) {
   ], GIT_TIMEOUTS.worktree);
   if (!diff.ok || !diff.stdout)
     return null;
-  const hash = createHash6("sha256");
+  const hash = createHash7("sha256");
   for (const line of diff.stdout.split(`
 `)) {
     if (line.startsWith("index "))
@@ -10209,14 +10236,14 @@ function diffHash(cwd, base, head) {
   return `sha256:${hash.digest("hex")}`;
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path6.resolve(cwd));
+  const location = resolveStore(path7.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path6.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path7.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
   const lock = `${file}.lock`;
@@ -10242,13 +10269,13 @@ function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
 }
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs4.openSync(file, "a+");
+    const fd = fs5.openSync(file, "a+");
     try {
-      const size = fs4.fstatSync(fd).size;
+      const size = fs5.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
         const last = Buffer.alloc(1);
-        fs4.readSync(fd, last, 0, 1, size - 1);
+        fs5.readSync(fd, last, 0, 1, size - 1);
         if (last[0] !== 10)
           fence = `
 `;
@@ -10257,17 +10284,17 @@ function appendLine(file, build, options) {
       if (!line.ok)
         return line;
       const bytes = Buffer.from(fence + line.value);
-      const written = fs4.writeSync(fd, bytes);
+      const written = fs5.writeSync(fd, bytes);
       if (written !== bytes.length)
         return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
       return { ok: true, value: undefined };
     } finally {
-      fs4.closeSync(fd);
+      fs5.closeSync(fd);
     }
   };
   try {
-    fs4.mkdirSync(path6.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path6.dirname(file)))
+    fs5.mkdirSync(path7.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path7.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -10321,7 +10348,7 @@ function readLedger(cwd, options = {}) {
     return file;
   let text = "";
   try {
-    text = fs4.readFileSync(file.value, "utf8");
+    text = fs5.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return {
@@ -10676,28 +10703,28 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, PASSING, FAILING, STRONG_RESULTS,
   if (process.platform !== "linux")
     return false;
   try {
-    return isNetworkFsType(fs4.statfsSync(dir).type);
+    return isNetworkFsType(fs5.statfsSync(dir).type);
   } catch {
     return false;
   }
 }, LOCK_WAIT_MS = 5000, LOCK_STALE_MS = 30000, LOCK_OWNER = "owner", lockToken = (lock) => {
   try {
-    return fs4.readFileSync(path6.join(lock, LOCK_OWNER), "utf8");
+    return fs5.readFileSync(path7.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 }, lockAgeMs = (lock) => {
-  for (const target of [path6.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path7.join(lock, LOCK_OWNER), lock]) {
     try {
-      return Date.now() - fs4.statSync(target).mtimeMs;
+      return Date.now() - fs5.statSync(target).mtimeMs;
     } catch {}
   }
   return null;
-}, ledgerLock, sha2562 = (text) => createHash6("sha256").update(text).digest("hex"), chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
+}, ledgerLock, sha2562 = (text) => createHash7("sha256").update(text).digest("hex"), chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
 ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
   for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
     const buffer = Buffer.alloc(span);
-    fs4.readSync(fd, buffer, 0, span, size - span);
+    fs5.readSync(fd, buffer, 0, span, size - span);
     const end = buffer.lastIndexOf(10);
     if (end < 0) {
       if (span === size)
@@ -10749,11 +10776,18 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
       return false;
     return scopeOf(own)({ branch: theirs, at: target.at });
   };
+}, derivesFrom = (derived, bare) => !bare.includes(":") && derived.endsWith(`:${bare}`), authoredBy = (authors, session) => {
+  if (authors.has(session))
+    return true;
+  for (const author of authors)
+    if (derivesFrom(author, session) || derivesFrom(session, author))
+      return true;
+  return false;
 }, independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
     reasons.push("no_session");
-  else if (authors.has(row.actor.session))
+  else if (authoredBy(authors, row.actor.session))
     reasons.push("author_session");
   if (row.self === true && !reasons.includes("no_session"))
     reasons.push("self");
@@ -10783,14 +10817,14 @@ var init_ledger = __esm(() => {
   ledgerLock = {
     acquire(lock) {
       try {
-        fs4.mkdirSync(lock);
+        fs5.mkdirSync(lock);
       } catch (error) {
         if (error.code === "EEXIST")
           return null;
         throw error;
       }
       const token = `${process.pid}-${randomBytes(8).toString("hex")}`;
-      fs4.writeFileSync(path6.join(lock, LOCK_OWNER), token);
+      fs5.writeFileSync(path7.join(lock, LOCK_OWNER), token);
       return token;
     },
     release(lock, token) {
@@ -10798,35 +10832,35 @@ var init_ledger = __esm(() => {
         return false;
       const tomb = `${lock}.release-${randomBytes(6).toString("hex")}`;
       try {
-        fs4.renameSync(lock, tomb);
+        fs5.renameSync(lock, tomb);
       } catch {
         return false;
       }
       if (lockToken(tomb) !== token) {
         try {
-          fs4.renameSync(tomb, lock);
+          fs5.renameSync(tomb, lock);
         } catch {}
         return false;
       }
-      fs4.rmSync(tomb, { recursive: true, force: true });
+      fs5.rmSync(tomb, { recursive: true, force: true });
       return true;
     },
     token: lockToken,
     reap(lock, observed) {
       const tomb = `${lock}.reap-${randomBytes(6).toString("hex")}`;
       try {
-        fs4.renameSync(lock, tomb);
+        fs5.renameSync(lock, tomb);
       } catch {
         return false;
       }
       if (lockToken(tomb) === observed) {
-        fs4.rmSync(tomb, { recursive: true, force: true });
+        fs5.rmSync(tomb, { recursive: true, force: true });
         return true;
       }
       try {
-        fs4.renameSync(tomb, lock);
+        fs5.renameSync(tomb, lock);
       } catch {
-        fs4.rmSync(tomb, { recursive: true, force: true });
+        fs5.rmSync(tomb, { recursive: true, force: true });
       }
       return false;
     }
@@ -10843,7 +10877,7 @@ var init_ledger = __esm(() => {
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync2 } from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 function deriveRequirements(judgment, scope, constraints, verification = "self") {
   const out = [];
   const base = { scope, dependentAction: null };
@@ -10995,7 +11029,7 @@ var RULES, derived2 = (spec) => ({
     decisionIds: []
   };
 }, planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync2(path7.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync2(path8.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -11592,7 +11626,7 @@ var init_safe_write = () => {};
 // packages/workit-core/src/autonomy.ts
 import os3 from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 function endpointOf(entry) {
   const raw = entry?.defaultEndpoint;
   if (raw === undefined)
@@ -11689,9 +11723,9 @@ var accountHome = () => {
   } catch {
     return os3.homedir();
   }
-}, grantsHome, grantsDir = () => path8.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
-  const configured = path8.resolve(resolveConfigDir());
-  return configured === path8.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path8.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+}, grantsHome, grantsDir = () => path9.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
+  const configured = path9.resolve(resolveConfigDir());
+  return configured === path9.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path9.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 }, GRANT_KINDS, DEFAULT_GRANTS, DEFAULT_ENDPOINTS, DEFAULT_ENDPOINT = "commit", isDefaultEndpoint = (value) => typeof value === "string" && DEFAULT_ENDPOINTS.includes(value), DEFAULT_VERIFICATION = "self", verificationOf = (entry) => entry?.verification === "independent" ? "independent" : "self", isGrantValue = (value) => value === true || value === false || value === "verified", normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value, fromAutoApprove = (value) => {
   if (value === true)
     return { push: true, pr: true, merge: "verified" };
@@ -11782,7 +11816,7 @@ function normalizeMaxBytes(value, options = {}) {
 }
 // node_modules/@openclaw/fs-safe/dist/bounded-read.js
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 function createScratchBuffer(maxBytes) {
   const initialReadBytes = Number.isFinite(maxBytes) ? Math.min(READ_CHUNK_BYTES, maxBytes + 1) : READ_CHUNK_BYTES;
   return Buffer.allocUnsafe(Math.max(1, initialReadBytes));
@@ -11805,7 +11839,7 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
   let total = 0;
   while (true) {
     const length = nextReadLength(total, maxBytes, scratch.length);
-    const bytesRead = fs5.readSync(fd, scratch, 0, length, null);
+    const bytesRead = fs6.readSync(fd, scratch, 0, length, null);
     if (bytesRead === 0) {
       return Buffer.concat(chunks, total);
     }
@@ -11819,9 +11853,9 @@ var init_bounded_read = __esm(() => {
 });
 // node_modules/@openclaw/fs-safe/dist/read-open-flags.js
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 function resolveReadOpenFlags(options) {
-  const constants = options?.constants ?? fs6.constants;
+  const constants = options?.constants ?? fs7.constants;
   const noFollow = process.platform !== "win32" && options?.followSymlinks !== true && typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
   const nonBlocking = process.platform !== "win32" && typeof constants.O_NONBLOCK === "number" ? constants.O_NONBLOCK : 0;
   return constants.O_RDONLY | noFollow | nonBlocking;
@@ -11831,7 +11865,7 @@ var init_read_open_flags = () => {};
 // node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
 import { randomBytes as randomBytes2 } from "node:crypto";
 import fsSync from "node:fs";
-import path9 from "node:path";
+import path10 from "node:path";
 function parseSidecarLockSnapshot(snapshot, parser) {
   return snapshot && { ...snapshot, payload: parseSidecarLockPayload(snapshot.raw, parser) };
 }
@@ -11859,13 +11893,13 @@ ${ownershipToken}
   return { raw, ownershipToken };
 }
 function relativeSidecarLockPath(lockRoot, lockPath) {
-  const resolved = path9.resolve(lockPath);
-  const lexicalRelative = path9.relative(lockRoot.rootDir, resolved);
-  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(lexicalRelative) ? lexicalRelative : path9.relative(lockRoot.rootReal, resolved);
-  if (!relative || relative === ".." || relative.startsWith(`..${path9.sep}`) || path9.isAbsolute(relative)) {
+  const resolved = path10.resolve(lockPath);
+  const lexicalRelative = path10.relative(lockRoot.rootDir, resolved);
+  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(lexicalRelative) ? lexicalRelative : path10.relative(lockRoot.rootReal, resolved);
+  if (!relative || relative === ".." || relative.startsWith(`..${path10.sep}`) || path10.isAbsolute(relative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock path is outside lockRoot");
   }
-  return relative.split(path9.sep).join(path9.posix.sep);
+  return relative.split(path10.sep).join(path10.posix.sep);
 }
 function parseSidecarLockPayload(raw, parser) {
   if (parser) {
@@ -12034,8 +12068,8 @@ function sleepSync(ms) {
 }
 // node_modules/@openclaw/fs-safe/dist/file-lock-sync.js
-import fs7 from "node:fs";
-import path10 from "node:path";
+import fs8 from "node:fs";
+import path11 from "node:path";
 function getSyncHeldLocks() {
   const globalWithState = globalThis;
   if (!globalWithState[SYNC_HELD_LOCKS_KEY]) {
@@ -12052,7 +12086,7 @@ function releaseAllSyncHeldLocks() {
     }
     try {
       if (held.fd !== undefined)
-        fs7.closeSync(held.fd);
+        fs8.closeSync(held.fd);
     } catch {}
     try {
       removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
@@ -12087,7 +12121,7 @@ function releaseSyncHeldLock(held) {
   if (held.fd !== undefined) {
     const fd = held.fd;
     held.fd = undefined;
-    fs7.closeSync(fd);
+    fs8.closeSync(fd);
   }
   removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
   heldLocks.delete(held.normalizedTargetPath);
@@ -12110,29 +12144,29 @@ function createSyncHeldLockHandle(held) {
   };
 }
 function canonicalLockParentSync(parent) {
-  return process.platform === "win32" ? fs7.realpathSync.native(parent) : fs7.realpathSync(parent);
+  return process.platform === "win32" ? fs8.realpathSync.native(parent) : fs8.realpathSync(parent);
 }
 function normalizeTargetPath(targetPath) {
-  const resolved = path10.resolve(targetPath);
-  fs7.mkdirSync(path10.dirname(resolved), { recursive: true });
+  const resolved = path11.resolve(targetPath);
+  fs8.mkdirSync(path11.dirname(resolved), { recursive: true });
   try {
-    return path10.join(canonicalLockParentSync(path10.dirname(resolved)), path10.basename(resolved));
+    return path11.join(canonicalLockParentSync(path11.dirname(resolved)), path11.basename(resolved));
   } catch {
     return resolved;
   }
 }
 function boundedLockPath(lockPath, lockRoot) {
-  const resolved = path10.resolve(lockPath);
+  const resolved = path11.resolve(lockPath);
   if (!lockRoot)
     return resolved;
   relativeSidecarLockPath(lockRoot, resolved);
-  const parent = path10.dirname(resolved);
+  const parent = path11.dirname(resolved);
   const parentReal = canonicalLockParentSync(parent);
-  const parentRelative = path10.relative(lockRoot.rootReal, parentReal);
-  if (parentRelative === ".." || parentRelative.startsWith(`..${path10.sep}`) || path10.isAbsolute(parentRelative)) {
+  const parentRelative = path11.relative(lockRoot.rootReal, parentReal);
+  if (parentRelative === ".." || parentRelative.startsWith(`..${path11.sep}`) || path11.isAbsolute(parentRelative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock parent is outside lockRoot");
   }
-  return path10.join(parentReal, path10.basename(resolved));
+  return path11.join(parentReal, path11.basename(resolved));
 }
 function defaultShouldReclaim(snapshot, staleMs, nowMs) {
   const createdAtMs = sidecarLockPayloadCreatedAtMs(snapshot.payload);
@@ -12142,7 +12176,7 @@ function defaultShouldReclaim(snapshot, staleMs, nowMs) {
 }
 function reclaimGuardExists(reclaimGuardPath) {
   try {
-    fs7.lstatSync(reclaimGuardPath);
+    fs8.lstatSync(reclaimGuardPath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT")
@@ -12206,19 +12240,19 @@ function acquireFileLockSync(targetPath, options) {
     const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
     let lockFileCreateDenied = false;
     try {
-      const noFollow = process.platform !== "win32" && typeof fs7.constants.O_NOFOLLOW === "number" ? fs7.constants.O_NOFOLLOW : 0;
+      const noFollow = process.platform !== "win32" && typeof fs8.constants.O_NOFOLLOW === "number" ? fs8.constants.O_NOFOLLOW : 0;
       try {
-        fd = fs7.openSync(lockPath, fs7.constants.O_WRONLY | fs7.constants.O_CREAT | fs7.constants.O_EXCL | noFollow, 384);
+        fd = fs8.openSync(lockPath, fs8.constants.O_WRONLY | fs8.constants.O_CREAT | fs8.constants.O_EXCL | noFollow, 384);
       } catch (error) {
         lockFileCreateDenied = isTransientLockFileDenial(error, lockPath);
         throw error;
       }
-      fs7.writeFileSync(fd, raw, "utf8");
-      fs7.fsyncSync(fd);
+      fs8.writeFileSync(fd, raw, "utf8");
+      fs8.fsyncSync(fd);
       const snapshot = {
         raw,
         payload,
-        stat: fs7.fstatSync(fd),
+        stat: fs8.fstatSync(fd),
         ownershipToken
       };
       const createdHeld = {
@@ -12253,8 +12287,8 @@ function acquireFileLockSync(targetPath, options) {
       return returnedHandle;
     } catch (error) {
       if (fd !== undefined) {
-        const failed = { payload: null, stat: fs7.fstatSync(fd) };
-        fs7.closeSync(fd);
+        const failed = { payload: null, stat: fs8.fstatSync(fd) };
+        fs8.closeSync(fd);
         fd = undefined;
         removeSidecarLockIfUnchangedSync(lockPath, failed);
       }
@@ -12303,7 +12337,7 @@ function acquireFileLockSync(targetPath, options) {
         })) {
           let ownsReclaimGuard = false;
           try {
-            fs7.mkdirSync(reclaimGuardPath);
+            fs8.mkdirSync(reclaimGuardPath);
             ownsReclaimGuard = true;
             if (removeSidecarLockIfUnchangedSync(lockPath, snapshot))
               continue;
@@ -12316,7 +12350,7 @@ function acquireFileLockSync(targetPath, options) {
           } finally {
             if (ownsReclaimGuard) {
               try {
-                fs7.rmdirSync(reclaimGuardPath);
+                fs8.rmdirSync(reclaimGuardPath);
               } catch {}
             }
           }
@@ -12349,13 +12383,13 @@ var init_file_lock = __esm(() => {
 // packages/workit-core/src/core/package-root.ts
 import { existsSync as existsSync3 } from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = () => {
-  let dir = path11.dirname(fileURLToPath(import.meta.url));
+  let dir = path12.dirname(fileURLToPath(import.meta.url));
   while (true) {
-    const parent = path11.dirname(dir);
-    if (existsSync3(path11.join(dir, "package.json")) || parent === dir)
+    const parent = path12.dirname(dir);
+    if (existsSync3(path12.join(dir, "package.json")) || parent === dir)
       return dir;
     dir = parent;
   }
@@ -12364,7 +12398,7 @@ var init_package_root = () => {};
 // packages/workit-core/src/core/store-lock.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 import { hostname } from "node:os";
 var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, RECLAIM_GUARD_TTL_MS = 30000, defaultLockTimeoutMs = 250, defaultLockTimeout = () => defaultLockTimeoutMs, parseMetadataLock = (raw) => {
   let value;
@@ -12391,7 +12425,7 @@ var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, REC
 }, processStartOf = (pid) => {
   if (process.platform === "linux") {
     try {
-      return parseProcStatStart(fs8.readFileSync(`/proc/${pid}/stat`, "utf8"));
+      return parseProcStatStart(fs9.readFileSync(`/proc/${pid}/stat`, "utf8"));
     } catch {
       return null;
     }
@@ -12411,7 +12445,7 @@ var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, REC
   return null;
 }, readTrimmed = (file) => {
   try {
-    return fs8.readFileSync(file, "utf8").trim() || null;
+    return fs9.readFileSync(file, "utf8").trim() || null;
   } catch {
     return null;
   }
@@ -12420,7 +12454,7 @@ var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, REC
     return cachedLockHost;
   let pidns = null;
   try {
-    pidns = /\[(\d+)\]/.exec(fs8.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
+    pidns = /\[(\d+)\]/.exec(fs9.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
   } catch {}
   const boot = readTrimmed("/proc/sys/kernel/random/boot_id");
   cachedLockHost = pidns || boot ? `${hostname()}#${pidns ?? "?"}:${boot ?? "?"}` : hostname();
@@ -12462,7 +12496,7 @@ var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, REC
   return { state: "live", reason: `held by running pid ${pid}` };
 }, ageOf = (file, nowMs) => {
   try {
-    return nowMs - fs8.lstatSync(file).mtimeMs;
+    return nowMs - fs9.lstatSync(file).mtimeMs;
   } catch {
     return null;
   }
@@ -12472,7 +12506,7 @@ var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, REC
   if (age === null || age <= RECLAIM_GUARD_TTL_MS)
     return false;
   try {
-    fs8.rmdirSync(guard);
+    fs9.rmdirSync(guard);
     return true;
   } catch {
     return false;
@@ -12495,12 +12529,12 @@ var init_store_lock = __esm(() => {
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import fs9 from "node:fs";
-import path12 from "node:path";
+import fs10 from "node:fs";
+import path13 from "node:path";
 function readLog(file, from = 0, expectSeq = null) {
   let fd;
   try {
-    fd = fs9.openSync(file, "r");
+    fd = fs10.openSync(file, "r");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -12509,13 +12543,13 @@ function readLog(file, from = 0, expectSeq = null) {
   let bytes;
   let size;
   try {
-    size = fs9.fstatSync(fd).size;
+    size = fs10.fstatSync(fd).size;
     if (from > size)
       throw new LogDamage(`${file}: shorter than its snapshot`);
     bytes = Buffer.alloc(size - from);
     let read = 0;
     while (read < bytes.length) {
-      const got = fs9.readSync(fd, bytes, read, bytes.length - read, from + read);
+      const got = fs10.readSync(fd, bytes, read, bytes.length - read, from + read);
       if (got === 0)
         break;
       read += got;
@@ -12523,7 +12557,7 @@ function readLog(file, from = 0, expectSeq = null) {
     bytes = bytes.subarray(0, read);
     size = from + read;
   } finally {
-    fs9.closeSync(fd);
+    fs10.closeSync(fd);
   }
   const events = [];
   let start = 0;
@@ -12549,46 +12583,46 @@ function readLog(file, from = 0, expectSeq = null) {
 function appendEvent(file, event, validEnd) {
   const line = Buffer.from(`${JSON.stringify(event)}
 `, "utf8");
-  const created = !fs9.existsSync(file);
-  if (!created && fs9.statSync(file).size !== validEnd) {
-    const cut = fs9.openSync(file, "r+");
+  const created = !fs10.existsSync(file);
+  if (!created && fs10.statSync(file).size !== validEnd) {
+    const cut = fs10.openSync(file, "r+");
     try {
-      fs9.ftruncateSync(cut, validEnd);
-      fs9.fsyncSync(cut);
+      fs10.ftruncateSync(cut, validEnd);
+      fs10.fsyncSync(cut);
     } finally {
-      fs9.closeSync(cut);
+      fs10.closeSync(cut);
     }
   }
-  const fd = fs9.openSync(file, "a", 384);
+  const fd = fs10.openSync(file, "a", 384);
   try {
     let written = 0;
     while (written < line.length)
-      written += fs9.writeSync(fd, line, written, line.length - written);
-    fs9.fsyncSync(fd);
+      written += fs10.writeSync(fd, line, written, line.length - written);
+    fs10.fsyncSync(fd);
   } finally {
-    fs9.closeSync(fd);
+    fs10.closeSync(fd);
   }
   if (created)
-    fsyncDirectory(path12.dirname(file));
+    fsyncDirectory(path13.dirname(file));
   return validEnd;
 }
 function replaceFile(file, bytes, durable) {
   const temporary = `${file}.${process.pid}.${randomUUID2()}.tmp`;
   try {
-    const fd = fs9.openSync(temporary, "wx", 384);
+    const fd = fs10.openSync(temporary, "wx", 384);
     try {
-      fs9.writeSync(fd, bytes);
+      fs10.writeSync(fd, bytes);
       if (durable)
-        fs9.fsyncSync(fd);
+        fs10.fsyncSync(fd);
     } finally {
-      fs9.closeSync(fd);
+      fs10.closeSync(fd);
     }
     renameWithRetry(temporary, file);
     if (durable)
-      fsyncDirectory(path12.dirname(file));
+      fsyncDirectory(path13.dirname(file));
   } catch (error) {
     try {
-      fs9.unlinkSync(temporary);
+      fs10.unlinkSync(temporary);
     } catch {}
     throw error;
   }
@@ -12609,11 +12643,11 @@ var EVENT_VERSION = 1, LogDamage, isObject4 = (value) => typeof value === "objec
   return value;
 }, fsyncDirectory = (dir) => {
   try {
-    const fd = fs9.openSync(dir, "r");
+    const fd = fs10.openSync(dir, "r");
     try {
-      fs9.fsyncSync(fd);
+      fs10.fsyncSync(fd);
     } finally {
-      fs9.closeSync(fd);
+      fs10.closeSync(fd);
     }
   } catch (error) {
     if (process.platform !== "win32")
@@ -12636,7 +12670,7 @@ var EVENT_VERSION = 1, LogDamage, isObject4 = (value) => typeof value === "objec
       Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5 * (attempt + 1));
     }
   }
-}, renameWithRetry = (from, to) => retryTransient(() => fs9.renameSync(from, to));
+}, renameWithRetry = (from, to) => retryTransient(() => fs10.renameSync(from, to));
 var init_event_log = __esm(() => {
   LogDamage = class LogDamage extends Error {
     upgrade;
@@ -12755,7 +12789,7 @@ var isPlainObject2 = (value) => typeof value === "object" && value !== null && !
 });
 // packages/workit-core/src/store/reduce.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 function reduce(state, event, blobs) {
   const data = event.data;
   const known = KNOWN_TYPES.has(event.type);
@@ -12822,7 +12856,7 @@ function eventType(before, after) {
     return "task.noted";
   return "task.updated";
 }
-var OPENING_TYPES, KNOWN_TYPES, isObject5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), isKey = (value) => isObject5(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string"), BLOB_REF = "$blob", blobRef = (value) => isObject5(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null, blobDigest = (value) => createHash7("sha256").update(JSON.stringify(value)).digest("hex"), toBlob = (value, blobs) => {
+var OPENING_TYPES, KNOWN_TYPES, isObject5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), isKey = (value) => isObject5(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string"), BLOB_REF = "$blob", blobRef = (value) => isObject5(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null, blobDigest = (value) => createHash8("sha256").update(JSON.stringify(value)).digest("hex"), toBlob = (value, blobs) => {
   if (!isObject5(value))
     return value;
   const digest = blobDigest(value);
@@ -12893,9 +12927,9 @@ var init_notes = __esm(() => {
 });
 // packages/workit-core/src/core/task-store.ts
-import { createHash as createHash8, randomUUID as randomUUID3 } from "node:crypto";
-import * as fs10 from "node:fs";
-import path13 from "node:path";
+import { createHash as createHash9, randomUUID as randomUUID3 } from "node:crypto";
+import * as fs11 from "node:fs";
+import path14 from "node:path";
 class TaskStore {
   root;
@@ -12907,8 +12941,8 @@ class TaskStore {
   migrationChecked = false;
   compactDue = new Set;
   constructor(root, options = {}) {
-    const resolved = path13.resolve(root);
-    this.origin = fs10.existsSync(resolved) ? fs10.realpathSync(resolved) : resolved;
+    const resolved = path14.resolve(root);
+    this.origin = fs11.existsSync(resolved) ? fs11.realpathSync(resolved) : resolved;
     this.located = resolveStore(this.origin);
     this.root = checkoutRootOf(this.origin, this.located);
     this.lockTimeoutMs = options.lockTimeoutMs ?? defaultLockTimeout();
@@ -12916,7 +12950,7 @@ class TaskStore {
     this.migrateOnRead = options.migrateOnRead;
   }
   location() {
-    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs10.existsSync(path13.join(this.root, ".git"))) {
+    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs11.existsSync(path14.join(this.root, ".git"))) {
       this.located = undefined;
       this.migrationChecked = false;
     }
@@ -12980,7 +13014,7 @@ class TaskStore {
     const tasksDir = this.paths().tasks;
     let names;
     try {
-      names = fs10.existsSync(tasksDir) ? fs10.readdirSync(tasksDir).filter((name) => validId(name)) : [];
+      names = fs11.existsSync(tasksDir) ? fs11.readdirSync(tasksDir).filter((name) => validId(name)) : [];
     } catch (error) {
       return failure2("storage_error", `unable to list tasks: ${String(error)}`, {
         path: tasksDir
@@ -13021,7 +13055,7 @@ class TaskStore {
     const file = this.paths().workspace;
     let bytes;
     try {
-      bytes = retryTransient(() => fs10.readFileSync(file, "utf8"));
+      bytes = retryTransient(() => fs11.readFileSync(file, "utf8"));
     } catch (error) {
       if (error.code === "ENOENT")
         return success(null, null, null);
@@ -13072,7 +13106,7 @@ class TaskStore {
         const moved = this.bindLocked(again.data.id, key, input.now);
         return moved.ok ? success(moved.data.revision, null, { task: moved.data, created: false, key }) : moved;
       }
-      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path13.basename(this.root) || this.root;
+      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path14.basename(this.root) || this.root;
       const intent = {
         objective: input.objective?.trim() || `Work on ${label}`,
         scope: { description: `the checkout (${label})`, paths: ["."], exclusions: [] },
@@ -13132,14 +13166,14 @@ class TaskStore {
     const branch = key.ok ? key.data.branch : null;
     if (!branch || !location.ok)
       return success(null, null, null);
-    const common = path13.dirname(location.data.dir);
-    const heads = path13.join(common, "logs", "refs", "heads");
-    const headLog = location.data.git ? path13.join(location.data.git.gitDir, "logs", "HEAD") : "";
+    const common = path14.dirname(location.data.dir);
+    const heads = path14.join(common, "logs", "refs", "heads");
+    const headLog = location.data.git ? path14.join(location.data.git.gitDir, "logs", "HEAD") : "";
     const signatures = [
-      path13.join(heads, branch),
+      path14.join(heads, branch),
       headLog,
       heads,
-      path13.join(common, "packed-refs")
+      path14.join(common, "packed-refs")
     ].map((file) => fileSignature(file) ?? "-");
     const slot = `${location.data.dir}\x00${headLog}\x00${branch}`;
     let resolved = origins.get(slot);
@@ -13151,7 +13185,7 @@ class TaskStore {
           aliases.push(rename.from);
       const start = branchStart(location.data, branch, aliases);
       const slash = start?.indexOf("/") ?? -1;
-      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path13.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
+      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path14.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
       const name = start && (remote ? start.slice(slash + 1) : start);
       resolved = {
         signature: signatures.join("|"),
@@ -13389,13 +13423,13 @@ class TaskStore {
     if (!ready.ok)
       return ready;
     const dirs = this.paths();
-    const recovery = path13.join(this.root, ".workit", "recovery");
-    if (fs10.existsSync(recovery)) {
+    const recovery = path14.join(this.root, ".workit", "recovery");
+    if (fs11.existsSync(recovery)) {
       let files = 0;
       let bytes = 0;
       try {
-        for (const name of fs10.readdirSync(recovery)) {
-          const stat = fs10.lstatSync(path13.join(recovery, name));
+        for (const name of fs11.readdirSync(recovery)) {
+          const stat = fs11.lstatSync(path14.join(recovery, name));
           if (!stat.isFile())
             continue;
           files += 1;
@@ -13404,17 +13438,17 @@ class TaskStore {
       } catch {}
       const remove = options.pruneRecovery === true && !dryRun;
       if (remove)
-        fs10.rmSync(recovery, { recursive: true, force: true });
+        fs11.rmSync(recovery, { recursive: true, force: true });
       report.legacyRecovery = { path: recovery, files, bytes, removed: remove };
     }
-    if (!fs10.existsSync(dirs.tasks))
+    if (!fs11.existsSync(dirs.tasks))
       return success(null, null, report);
-    const names = fs10.readdirSync(dirs.tasks).filter((name) => validId(name));
+    const names = fs11.readdirSync(dirs.tasks).filter((name) => validId(name));
     for (const name of names) {
       const file = this.eventsPath(name);
       let size = 0;
       try {
-        size = fs10.statSync(file).size;
+        size = fs11.statSync(file).size;
       } catch {
         continue;
       }
@@ -13442,16 +13476,16 @@ class TaskStore {
       const references = new Set;
       for (const name of names)
         try {
-          for (const match of fs10.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
+          for (const match of fs11.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
             references.add(match[1]);
         } catch {}
-      if (fs10.existsSync(dirs.blobs))
-        for (const name of fs10.readdirSync(dirs.blobs)) {
+      if (fs11.existsSync(dirs.blobs))
+        for (const name of fs11.readdirSync(dirs.blobs)) {
           const digest = name.replace(/\.json$/, "");
-          const file = path13.join(dirs.blobs, name);
+          const file = path14.join(dirs.blobs, name);
           let stat;
           try {
-            stat = fs10.lstatSync(file);
+            stat = fs11.lstatSync(file);
           } catch {
             continue;
           }
@@ -13462,11 +13496,11 @@ class TaskStore {
           report.blobs.removed += 1;
           report.blobs.removedBytes += stat.size;
           if (!dryRun)
-            fs10.rmSync(file, { force: true });
+            fs11.rmSync(file, { force: true });
         }
       return success(null, null, null);
     };
-    const swept = dryRun ? sweep() : this.withLock(path13.join(dirs.dir, "gc.lock"), sweep);
+    const swept = dryRun ? sweep() : this.withLock(path14.join(dirs.dir, "gc.lock"), sweep);
     if (!swept.ok)
       return swept;
     const temporaryDirs = [
@@ -13474,17 +13508,17 @@ class TaskStore {
       dirs.tasks,
       dirs.blobs,
       dirs.checkout,
-      ...names.map((name) => path13.join(dirs.tasks, name))
+      ...names.map((name) => path14.join(dirs.tasks, name))
     ];
     for (const directory of temporaryDirs) {
-      if (!fs10.existsSync(directory))
+      if (!fs11.existsSync(directory))
         continue;
-      for (const name of fs10.readdirSync(directory)) {
+      for (const name of fs11.readdirSync(directory)) {
         if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
           continue;
-        const file = path13.join(directory, name);
+        const file = path14.join(directory, name);
         try {
-          const stat = fs10.lstatSync(file);
+          const stat = fs11.lstatSync(file);
           if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
             continue;
         } catch {
@@ -13492,37 +13526,37 @@ class TaskStore {
         }
         report.temporary.removed += 1;
         if (!dryRun)
-          fs10.rmSync(file, { force: true });
+          fs11.rmSync(file, { force: true });
       }
     }
     return success(null, null, report);
   }
   paths() {
     const location = this.location();
-    const dir = location.ok ? location.data.dir : path13.join(this.root, ".workit");
-    const checkout = path13.join(dir, "checkouts", checkoutSlug(this.root));
+    const dir = location.ok ? location.data.dir : path14.join(this.root, ".workit");
+    const checkout = path14.join(dir, "checkouts", checkoutSlug(this.root));
     return {
       dir,
       shared: location.ok ? location.data.shared : false,
-      marker: path13.join(dir, "store.json"),
+      marker: path14.join(dir, "store.json"),
       checkout,
-      workspace: path13.join(checkout, "workspace.json"),
-      checkoutLock: path13.join(checkout, "metadata.lock"),
-      tasks: path13.join(dir, "tasks"),
-      index: path13.join(dir, "task-index.json"),
-      blobs: path13.join(dir, "blobs", "candidates"),
-      legacy: path13.join(dir, "legacy", checkoutSlug(this.root), "v2"),
-      v2: path13.join(this.root, ".workit")
+      workspace: path14.join(checkout, "workspace.json"),
+      checkoutLock: path14.join(checkout, "metadata.lock"),
+      tasks: path14.join(dir, "tasks"),
+      index: path14.join(dir, "task-index.json"),
+      blobs: path14.join(dir, "blobs", "candidates"),
+      legacy: path14.join(dir, "legacy", checkoutSlug(this.root), "v2"),
+      v2: path14.join(this.root, ".workit")
     };
   }
   eventsPath(taskId) {
-    return path13.join(this.paths().tasks, taskId, "events.jsonl");
+    return path14.join(this.paths().tasks, taskId, "events.jsonl");
   }
   snapshotPath(taskId) {
-    return path13.join(this.paths().tasks, taskId, "snapshot.json");
+    return path14.join(this.paths().tasks, taskId, "snapshot.json");
   }
   taskLockPath(taskId) {
-    return path13.join(this.paths().tasks, taskId, "lock");
+    return path14.join(this.paths().tasks, taskId, "lock");
   }
   ready(write = false) {
     const location = this.location();
@@ -13532,7 +13566,7 @@ class TaskStore {
       return success(null, null, null);
     const dirs = this.paths();
     try {
-      const marker = JSON.parse(fs10.readFileSync(dirs.marker, "utf8"));
+      const marker = JSON.parse(fs11.readFileSync(dirs.marker, "utf8"));
       if (typeof marker.version === "number" && marker.version > STORE_FORMAT)
         return failure2("recovery_required", `the workit store at ${dirs.dir} has format ${marker.version}; upgrade Workit to use it`, { path: dirs.marker });
     } catch {}
@@ -13561,21 +13595,21 @@ class TaskStore {
     return {
       read: (digest) => {
         try {
-          return JSON.parse(fs10.readFileSync(path13.join(dir, `${digest}.json`), "utf8"));
+          return JSON.parse(fs11.readFileSync(path14.join(dir, `${digest}.json`), "utf8"));
         } catch (error) {
           throw new LogDamage(`stored candidate ${digest} is missing or unreadable: ${String(error)}`);
         }
       },
       write: (digest, value) => {
-        const file = path13.join(dir, `${digest}.json`);
-        if (fs10.existsSync(file)) {
+        const file = path14.join(dir, `${digest}.json`);
+        if (fs11.existsSync(file)) {
           const stamp = new Date;
           try {
-            fs10.utimesSync(file, stamp, stamp);
+            fs11.utimesSync(file, stamp, stamp);
             return;
           } catch {}
         }
-        fs10.mkdirSync(dir, { recursive: true });
+        fs11.mkdirSync(dir, { recursive: true });
         replaceFile(file, JSON.stringify(value), true);
       }
     };
@@ -13657,7 +13691,7 @@ class TaskStore {
   }
   readSnapshot(taskId) {
     try {
-      const value = JSON.parse(fs10.readFileSync(this.snapshotPath(taskId), "utf8"));
+      const value = JSON.parse(fs11.readFileSync(this.snapshotPath(taskId), "utf8"));
       if (!isObject6(value) || value.v !== 1 || value.task !== taskId || typeof value.seq !== "number" || typeof value.lastId !== "string" || typeof value.lastStart !== "number" || typeof value.end !== "number" || !isObject6(value.record))
         return null;
       return value;
@@ -13759,8 +13793,8 @@ class TaskStore {
     }
   }
   openTask(record, type, key, legacy = null) {
-    const dir = path13.join(this.paths().tasks, record.id);
-    fs10.mkdirSync(dir, { recursive: true });
+    const dir = path14.join(this.paths().tasks, record.id);
+    fs11.mkdirSync(dir, { recursive: true });
     const blobs = this.blobStore();
     const bound = key ? { ...key, boundAt: key.boundAt ?? new Date().toISOString() } : null;
     const event = this.event(record.id, 1, type, {
@@ -13812,11 +13846,11 @@ class TaskStore {
         } catch {}
         if (!latest || latest.events[0]?.id !== last.id)
           return failure2("busy", "the task log changed during compaction; retry", { taskId });
-        const appended = fs10.readFileSync(file).subarray(log.end, latest.end);
+        const appended = fs11.readFileSync(file).subarray(log.end, latest.end);
         const bytes = Buffer.concat([Buffer.from(prefix, "utf8"), appended]);
         replaceFile(file, bytes.toString("utf8"), true);
         try {
-          fs10.rmSync(this.snapshotPath(taskId), { force: true });
+          fs11.rmSync(this.snapshotPath(taskId), { force: true });
         } catch {}
         const reloaded = this.load(taskId);
         if (reloaded.ok && reloaded.data)
@@ -13829,7 +13863,7 @@ class TaskStore {
   }
   countEvents(file) {
     try {
-      const bytes = fs10.readFileSync(file);
+      const bytes = fs11.readFileSync(file);
       let count = 0;
       for (let index = bytes.indexOf(10);index >= 0; index = bytes.indexOf(10, index + 1))
         count += 1;
@@ -13851,8 +13885,8 @@ class TaskStore {
     return bound.ok ? success(null, null, bound.data[0] ?? null) : bound;
   }
   withKeyLock(key, operation) {
-    const digest = createHash8("sha256").update(key).digest("hex").slice(0, 32);
-    return this.withLock(path13.join(this.paths().dir, "keys", `${digest}.lock`), operation);
+    const digest = createHash9("sha256").update(key).digest("hex").slice(0, 32);
+    return this.withLock(path14.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
     const current = this.readWorkspace();
@@ -13993,7 +14027,7 @@ class TaskStore {
   writeWorkspace(record) {
     const file = this.paths().workspace;
     try {
-      fs10.mkdirSync(path13.dirname(file), { recursive: true });
+      fs11.mkdirSync(path14.dirname(file), { recursive: true });
       replaceFile(file, `${canonicalJson(record)}
 `, true);
       return success(null, null, null);
@@ -14003,7 +14037,7 @@ class TaskStore {
   }
   readIndex() {
     try {
-      const value = JSON.parse(fs10.readFileSync(this.paths().index, "utf8"));
+      const value = JSON.parse(fs11.readFileSync(this.paths().index, "utf8"));
       if (!isObject6(value) || value.version !== INDEX_VERSION || !isObject6(value.tasks))
         return {};
       const tasks = {};
@@ -14017,7 +14051,7 @@ class TaskStore {
   }
   writeIndex(entries) {
     try {
-      fs10.mkdirSync(this.paths().tasks, { recursive: true });
+      fs11.mkdirSync(this.paths().tasks, { recursive: true });
       replaceFile(this.paths().index, JSON.stringify({
         version: INDEX_VERSION,
         tasks: Object.fromEntries(entries.map((entry) => [entry.id, entry]))
@@ -14071,23 +14105,23 @@ class TaskStore {
     return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
   }
   v2Dirs() {
-    return [...new Set([this.root, this.origin])].map((dir) => path13.join(dir, ".workit"));
+    return [...new Set([this.root, this.origin])].map((dir) => path14.join(dir, ".workit"));
   }
   pendingMigrations() {
     return this.v2Dirs().filter((dir) => {
-      const raw = this.readV2Workspace(path13.join(dir, "workspace.json"));
+      const raw = this.readV2Workspace(path14.join(dir, "workspace.json"));
       return raw !== null && raw !== TOMBSTONE;
     });
   }
   migrateV2(v2) {
     const dirs = this.paths();
-    const v2Workspace = path13.join(v2, "workspace.json");
-    const v2Tasks = path13.join(v2, "tasks");
-    const legacy = path13.join(dirs.dir, "legacy", checkoutSlug(path13.dirname(v2)), "v2");
+    const v2Workspace = path14.join(v2, "workspace.json");
+    const v2Tasks = path14.join(v2, "tasks");
+    const legacy = path14.join(dirs.dir, "legacy", checkoutSlug(path14.dirname(v2)), "v2");
     const raw = this.readV2Workspace(v2Workspace);
     if (raw === null || raw === TOMBSTONE)
       return success(null, null, null);
-    return this.withLock(dirs.checkoutLock, () => this.withLock(path13.join(v2, "metadata.lock"), () => {
+    return this.withLock(dirs.checkoutLock, () => this.withLock(path14.join(v2, "metadata.lock"), () => {
       const workspace = this.readV2Workspace(v2Workspace);
       if (workspace === null || workspace === TOMBSTONE)
         return success(null, null, null);
@@ -14096,7 +14130,7 @@ class TaskStore {
         return failure2("recovery_required", `cannot migrate the 2.x store at ${v2}: ${parsedWorkspace.error}; move it aside to start fresh`, { path: v2Workspace });
       let files = [];
       try {
-        files = fs10.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path13.join(v2Tasks, name)));
+        files = fs11.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path14.join(v2Tasks, name)));
       } catch {}
       const current = this.readWorkspace();
       if (!current.ok)
@@ -14114,22 +14148,22 @@ class TaskStore {
       let skipped = 0;
       const done = new Map;
       try {
-        fs10.mkdirSync(path13.join(legacy, "tasks"), { recursive: true });
+        fs11.mkdirSync(path14.join(legacy, "tasks"), { recursive: true });
         for (const name of ["workspace.json", "index.json"])
-          if (fs10.existsSync(path13.join(v2, name)))
-            fs10.copyFileSync(path13.join(v2, name), path13.join(legacy, name));
+          if (fs11.existsSync(path14.join(v2, name)))
+            fs11.copyFileSync(path14.join(v2, name), path14.join(legacy, name));
         for (const name of files) {
           const id = name.slice(0, -5);
-          const file = path13.join(v2Tasks, name);
-          const bytes = fs10.readFileSync(file, "utf8");
+          const file = path14.join(v2Tasks, name);
+          const bytes = fs11.readFileSync(file, "utf8");
           const digest = sha256(bytes);
-          fs10.writeFileSync(path13.join(legacy, "tasks", name), bytes);
+          fs11.writeFileSync(path14.join(legacy, "tasks", name), bytes);
           const parsed = this.parseRecord(bytes, taskRecordSchema, "2.x task");
           if (!parsed.ok || parsed.data.id !== id)
             return failure2("recovery_required", `cannot migrate 2.x task ${id}: ${parsed.ok ? "file name and record ID differ" : parsed.error}; move ${file} aside to continue`, { path: file });
           const record = { ...parsed.data, workspaceId: target.id };
-          const origin = { path: path13.join(legacy, "tasks", name), digest };
-          if (!fs10.existsSync(this.eventsPath(id))) {
+          const origin = { path: path14.join(legacy, "tasks", name), digest };
+          if (!fs11.existsSync(this.eventsPath(id))) {
             this.openTask(record, "migrated.from_v2", null, origin);
             migrated += 1;
           } else {
@@ -14164,8 +14198,8 @@ class TaskStore {
       try {
         let complete = true;
         for (const [name, digest] of done) {
-          const file = path13.join(v2Tasks, name);
-          if (sha256(fs10.readFileSync(file, "utf8")) !== digest) {
+          const file = path14.join(v2Tasks, name);
+          if (sha256(fs11.readFileSync(file, "utf8")) !== digest) {
             complete = false;
             continue;
           }
@@ -14175,7 +14209,7 @@ class TaskStore {
           return failure2("busy", `the 2.x store at ${v2} changed during migration; retry`, {
             path: v2
           });
-        fs10.rmSync(path13.join(v2, "index.json"), { force: true });
+        fs11.rmSync(path14.join(v2, "index.json"), { force: true });
         this.writeTombstone(v2, target.id);
       } catch (error) {
         return failure2("storage_error", `cannot finish the 2.x migration: ${String(error)}`, {
@@ -14195,45 +14229,45 @@ class TaskStore {
   }
   adoptLocalStore() {
     const dirs = this.paths();
-    const marker = path13.join(dirs.v2, "store.json");
-    if (!dirs.shared || !fs10.existsSync(marker))
+    const marker = path14.join(dirs.v2, "store.json");
+    if (!dirs.shared || !fs11.existsSync(marker))
       return success(null, null, null);
     return this.withLock(dirs.checkoutLock, () => {
-      if (!fs10.existsSync(marker))
+      if (!fs11.existsSync(marker))
         return success(null, null, null);
       let tasks = 0;
       try {
         const merge = (from, to) => {
-          if (!fs10.existsSync(to)) {
-            fs10.mkdirSync(path13.dirname(to), { recursive: true });
+          if (!fs11.existsSync(to)) {
+            fs11.mkdirSync(path14.dirname(to), { recursive: true });
             try {
-              fs10.renameSync(from, to);
+              fs11.renameSync(from, to);
             } catch {
-              fs10.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
-              fs10.rmSync(from, { recursive: true, force: true });
+              fs11.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
+              fs11.rmSync(from, { recursive: true, force: true });
             }
             return;
           }
-          if (fs10.lstatSync(from).isDirectory() && fs10.lstatSync(to).isDirectory())
-            for (const name of fs10.readdirSync(from))
-              merge(path13.join(from, name), path13.join(to, name));
+          if (fs11.lstatSync(from).isDirectory() && fs11.lstatSync(to).isDirectory())
+            for (const name of fs11.readdirSync(from))
+              merge(path14.join(from, name), path14.join(to, name));
         };
         for (const sub of ["tasks", "checkouts", "blobs", "legacy"]) {
-          const from = path13.join(dirs.v2, sub);
-          if (!fs10.existsSync(from))
+          const from = path14.join(dirs.v2, sub);
+          if (!fs11.existsSync(from))
             continue;
           if (sub === "tasks") {
-            for (const name of fs10.readdirSync(from))
-              if (validId(name) && !fs10.existsSync(path13.join(dirs.dir, sub, name)))
+            for (const name of fs11.readdirSync(from))
+              if (validId(name) && !fs11.existsSync(path14.join(dirs.dir, sub, name)))
                 tasks += 1;
           }
-          merge(from, path13.join(dirs.dir, sub));
+          merge(from, path14.join(dirs.dir, sub));
         }
-        const ledger = path13.join(dirs.v2, "ledger");
-        if (fs10.existsSync(ledger) && !fs10.existsSync(path13.join(dirs.dir, "ledger")))
-          merge(ledger, path13.join(dirs.dir, "ledger"));
-        fs10.rmSync(path13.join(dirs.v2, "task-index.json"), { force: true });
-        fs10.renameSync(marker, path13.join(dirs.v2, "store.moved.json"));
+        const ledger = path14.join(dirs.v2, "ledger");
+        if (fs11.existsSync(ledger) && !fs11.existsSync(path14.join(dirs.dir, "ledger")))
+          merge(ledger, path14.join(dirs.dir, "ledger"));
+        fs11.rmSync(path14.join(dirs.v2, "task-index.json"), { force: true });
+        fs11.renameSync(marker, path14.join(dirs.v2, "store.moved.json"));
       } catch (error) {
         return failure2("storage_error", `cannot move ${dirs.v2} into ${dirs.dir}: ${String(error)}`, {
           path: dirs.v2
@@ -14253,7 +14287,7 @@ class TaskStore {
   readV2Workspace(file) {
     let bytes;
     try {
-      bytes = fs10.readFileSync(file, "utf8");
+      bytes = fs11.readFileSync(file, "utf8");
     } catch {
       return null;
     }
@@ -14271,7 +14305,7 @@ class TaskStore {
       schemaVersion: SCHEMA_VERSION,
       id: workspaceId ?? newId(),
       revision: newRevision(),
-      root: path13.dirname(v2),
+      root: path14.dirname(v2),
       runtime: { createdWith: version, updatedWith: version },
       writer: null,
       store: {
@@ -14282,12 +14316,12 @@ class TaskStore {
       },
       critical: ["store"]
     };
-    fs10.mkdirSync(v2, { recursive: true });
-    const ignore = path13.join(v2, ".gitignore");
-    if (!fs10.existsSync(ignore))
-      fs10.writeFileSync(ignore, `*
+    fs11.mkdirSync(v2, { recursive: true });
+    const ignore = path14.join(v2, ".gitignore");
+    if (!fs11.existsSync(ignore))
+      fs11.writeFileSync(ignore, `*
 `);
-    replaceFile(path13.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
+    replaceFile(path14.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
 `, true);
   }
   stubFor(taskId) {
@@ -14303,7 +14337,7 @@ class TaskStore {
   }
   isStub(file) {
     try {
-      const value = JSON.parse(fs10.readFileSync(file, "utf8"));
+      const value = JSON.parse(fs11.readFileSync(file, "utf8"));
       return isObject6(value) && isObject6(value.store) && value.store.format === "workit-store";
     } catch {
       return false;
@@ -14311,32 +14345,32 @@ class TaskStore {
   }
   writeTombstoneIfMissing() {
     try {
-      const v2 = path13.join(this.root, ".workit");
-      if (fs10.existsSync(path13.join(v2, "workspace.json")))
+      const v2 = path14.join(this.root, ".workit");
+      if (fs11.existsSync(path14.join(v2, "workspace.json")))
         return;
       let id = null;
       try {
-        id = JSON.parse(fs10.readFileSync(this.paths().workspace, "utf8")).id ?? null;
+        id = JSON.parse(fs11.readFileSync(this.paths().workspace, "utf8")).id ?? null;
       } catch {}
       this.writeTombstone(v2, id);
     } catch {}
   }
   initializeStorage() {
     const dirs = this.paths();
-    retryTransient(() => fs10.mkdirSync(dirs.checkout, { recursive: true }));
-    retryTransient(() => fs10.mkdirSync(dirs.tasks, { recursive: true }));
-    if (!fs10.existsSync(dirs.marker))
+    retryTransient(() => fs11.mkdirSync(dirs.checkout, { recursive: true }));
+    retryTransient(() => fs11.mkdirSync(dirs.tasks, { recursive: true }));
+    if (!fs11.existsSync(dirs.marker))
       replaceFile(dirs.marker, `${JSON.stringify({ format: "workit-store", version: STORE_FORMAT, createdWith: runtimeVersion() })}
 `, false);
     if (!dirs.shared) {
-      const ignore = path13.join(dirs.dir, ".gitignore");
+      const ignore = path14.join(dirs.dir, ".gitignore");
       let current = null;
       try {
-        current = fs10.readFileSync(ignore, "utf8");
+        current = fs11.readFileSync(ignore, "utf8");
       } catch {}
       if (current !== `*
 `)
-        retryTransient(() => fs10.writeFileSync(ignore, `*
+        retryTransient(() => fs11.writeFileSync(ignore, `*
 `));
     }
     this.writeTombstoneIfMissing();
@@ -14352,7 +14386,7 @@ class TaskStore {
       shouldReclaim: ({ payload, nowMs }) => {
         let ageMs = null;
         try {
-          ageMs = nowMs - fs10.lstatSync(lockPath).mtimeMs;
+          ageMs = nowMs - fs11.lstatSync(lockPath).mtimeMs;
         } catch {}
         return classifyLockOwner(payload, ageMs, localLockHost(), TASK_STORE_LOCK).state === "stale";
       },
@@ -14389,7 +14423,7 @@ class TaskStore {
   withLock(lockPath, operation) {
     try {
       this.initializeStorage();
-      fs10.mkdirSync(path13.dirname(lockPath), { recursive: true });
+      fs11.mkdirSync(path14.dirname(lockPath), { recursive: true });
     } catch (error) {
       return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.paths().dir
@@ -14429,18 +14463,18 @@ class TaskStore {
   lockDirWritable(lockPath) {
     const probe = `${lockPath}.${process.pid}.${randomUUID3()}.probe`;
     try {
-      fs10.closeSync(fs10.openSync(probe, "wx", 384));
+      fs11.closeSync(fs11.openSync(probe, "wx", 384));
     } catch {
       return false;
     }
     try {
-      fs10.rmSync(probe, { force: true });
+      fs11.rmSync(probe, { force: true });
     } catch {}
     return true;
   }
   lockHolderPresent(lockPath) {
     try {
-      fs10.lstatSync(lockPath);
+      fs11.lstatSync(lockPath);
       return true;
     } catch (error) {
       return error?.code !== "ENOENT";
@@ -14452,12 +14486,12 @@ class TaskStore {
     if (isTransientWindowsError(error) && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
       return failure2("storage_error", `cannot create the workit lock (${code}); no other Workit call holds it`, {
         path: lockPath,
-        guidance: `Check permissions and the read-only attribute on ${path13.dirname(lockPath)}.`
+        guidance: `Check permissions and the read-only attribute on ${path14.dirname(lockPath)}.`
       });
     if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
       let lock = null;
       try {
-        lock = parseMetadataLockOrNull(fs10.readFileSync(lockPath, "utf8"));
+        lock = parseMetadataLockOrNull(fs11.readFileSync(lockPath, "utf8"));
       } catch {}
       return failure2("busy", `workit lock is held by another Workit call${lock ? ` (pid ${lock.pid} on ${lock.host})` : ""}; retry shortly`, {
         outcome: "not_started",
@@ -14498,7 +14532,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
   };
 }, fileSignature = (file) => {
   try {
-    const stat = fs10.statSync(file, { bigint: true });
+    const stat = fs11.statSync(file, { bigint: true });
     return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
   } catch {
     return null;
@@ -14510,7 +14544,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
 }, now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"), oldestFirst = (left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id), cachedRuntimeVersion = null, runtimeVersion = () => {
   if (cachedRuntimeVersion === null) {
     try {
-      const pkg = JSON.parse(fs10.readFileSync(path13.join(packageRoot(), "package.json"), "utf8"));
+      const pkg = JSON.parse(fs11.readFileSync(path14.join(packageRoot(), "package.json"), "utf8"));
       cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
     } catch {
       cachedRuntimeVersion = "0.0.0";
@@ -14532,12 +14566,12 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
   return false;
 }, validId = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value), readText = (file) => {
   try {
-    return fs10.readFileSync(file, "utf8");
+    return fs11.readFileSync(file, "utf8");
   } catch {
     return "";
   }
 }, REFLOG_LINE, branchStart = (location, branch, aliases) => {
-  const first = readText(path13.join(path13.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
+  const first = readText(path14.join(path14.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
 `, 1)[0];
   const created = REFLOG_LINE.exec(first);
   const start = created && /^branch: Created from (\S+)$/u.exec(created[3])?.[1];
@@ -14547,7 +14581,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
     return start;
   if (!location.git)
     return null;
-  for (const line of readText(path13.join(location.git.gitDir, "logs", "HEAD")).split(`
+  for (const line of readText(path14.join(location.git.gitDir, "logs", "HEAD")).split(`
 `)) {
     const entry = REFLOG_LINE.exec(line);
     const moved = entry && /^checkout: moving from (\S+) to (\S+)$/u.exec(entry[3]);
@@ -14556,21 +14590,21 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
       return moved[1];
   }
   return null;
-}, refExists = (common, ref) => fs10.existsSync(path13.join(common, ref)) || readText(path13.join(common, "packed-refs")).includes(` ${ref}
+}, refExists = (common, ref) => fs11.existsSync(path14.join(common, ref)) || readText(path14.join(common, "packed-refs")).includes(` ${ref}
 `), origins, sameDirectoryIdentity = (left, right) => {
-  if (!path13.isAbsolute(left) || !path13.isAbsolute(right))
+  if (!path14.isAbsolute(left) || !path14.isAbsolute(right))
     return false;
-  const normalizedLeft = path13.resolve(left);
-  const normalizedRight = path13.resolve(right);
+  const normalizedLeft = path14.resolve(left);
+  const normalizedRight = path14.resolve(right);
   try {
-    const a = fs10.statSync(normalizedLeft, { bigint: true });
-    const b = fs10.statSync(normalizedRight, { bigint: true });
+    const a = fs11.statSync(normalizedLeft, { bigint: true });
+    const b = fs11.statSync(normalizedRight, { bigint: true });
     if (!a.isDirectory() || !b.isDirectory())
       return false;
     if (process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight)
       return true;
-    const canonicalLeft = fs10.realpathSync(normalizedLeft);
-    const canonicalRight = fs10.realpathSync(normalizedRight);
+    const canonicalLeft = fs11.realpathSync(normalizedLeft);
+    const canonicalRight = fs11.realpathSync(normalizedRight);
     if (process.platform === "win32" ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase() : canonicalLeft === canonicalRight)
       return true;
     return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
@@ -14618,8 +14652,8 @@ var init_workers = __esm(() => {
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import fs11 from "node:fs";
-import path14 from "node:path";
+import fs12 from "node:fs";
+import path15 from "node:path";
 function splitCommand(command) {
   const argv = [];
   let current = "";
@@ -14657,12 +14691,12 @@ function splitCommand(command) {
   return argv.length ? argv : new Error("empty command");
 }
 function checkRoot(cwd) {
-  return path14.resolve(git4(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+  return path15.resolve(git4(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
 }
 function detectedChecks(root) {
   const read = (file) => {
     try {
-      return fs11.readFileSync(path14.join(root, file), "utf8");
+      return fs12.readFileSync(path15.join(root, file), "utf8");
     } catch {
       return null;
     }
@@ -14700,7 +14734,7 @@ function detectedChecks(root) {
 }
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
-  const file = path14.join(root, CHECKS_FILE);
+  const file = path15.join(root, CHECKS_FILE);
   const none = (error = null) => ({
     source: error ? CHECKS_FILE : "none",
     root,
@@ -14710,7 +14744,7 @@ function loadCheckConfig(cwd) {
   });
   let text = null;
   try {
-    text = fs11.readFileSync(file, "utf8");
+    text = fs12.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
       return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
@@ -14771,10 +14805,10 @@ function workitAvailable(env = process.env) {
     return workitOnPath;
   const windows = process.platform === "win32";
   const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  const dirs = (env.PATH ?? env.Path ?? "").split(path14.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path15.delimiter).filter(Boolean);
   workitOnPath = dirs.some((dir) => exts.some((ext) => {
     try {
-      return fs11.statSync(path14.join(dir, `workit${ext}`)).isFile();
+      return fs12.statSync(path15.join(dir, `workit${ext}`)).isFile();
     } catch {
       return false;
     }
@@ -14795,7 +14829,7 @@ var SCRIPT_CHECKS, CHECKS_FILE = "workit.checks.json", isRecord3 = (value) => ty
   const value = run.status === 0 ? (run.stdout ?? "").trim() : "";
   return value || null;
 }, packageManager = (root) => {
-  const has = (file) => fs11.existsSync(path14.join(root, file));
+  const has = (file) => fs12.existsSync(path15.join(root, file));
   if (has("bun.lock") || has("bun.lockb"))
     return "bun";
   if (has("pnpm-lock.yaml"))
@@ -14818,14 +14852,14 @@ var init_check_config = __esm(() => {
 });
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash9 } from "node:crypto";
-import * as fs12 from "node:fs";
+import { createHash as createHash10 } from "node:crypto";
+import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path15 from "node:path";
+import path16 from "node:path";
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs12.realpathSync(root);
+    checkout = fs13.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -14843,11 +14877,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs12.existsSync(target))
+    if (!fs13.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs12.lstatSync(target);
+      stat = fs13.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -14863,17 +14897,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path15.join(checkout, item);
+    const target = path16.join(checkout, item);
     try {
-      const stat = fs12.lstatSync(target);
+      const stat = fs13.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs12.readlinkSync(target);
+        const link = fs13.readlinkSync(target);
         files.push({ path: item, kind: "symlink", digest: digestBytes(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes(fs12.readFileSync(target)),
+          digest: digestBytes(fs13.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -15236,12 +15270,12 @@ function evaluateClosure(requestedOutcome, view) {
     requirementIds: evaluations.map((item) => item.requirementId)
   });
 }
-var digestBytes = (value) => createHash9("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path15.sep}`), relative = (root, candidate) => path15.relative(root, candidate).split(path15.sep).join("/") || ".", canonicalPath = (value) => {
+var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path16.sep}`), relative = (root, candidate) => path16.relative(root, candidate).split(path16.sep).join("/") || ".", canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path15.posix.normalize(value);
+  const normalized = path16.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -15283,20 +15317,20 @@ var digestBytes = (value) => createHash9("sha256").update(value).digest("hex"),
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path15.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path15.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 }, walk = (root, directory, output) => {
   let names;
   try {
-    names = fs12.readdirSync(directory);
+    names = fs13.readdirSync(directory);
   } catch {
     return true;
   }
@@ -15304,10 +15338,10 @@ var digestBytes = (value) => createHash9("sha256").update(value).digest("hex"),
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path15.join(directory, name);
+    const target = path16.join(directory, name);
     let stat;
     try {
-      stat = fs12.lstatSync(target);
+      stat = fs13.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -15321,14 +15355,14 @@ var digestBytes = (value) => createHash9("sha256").update(value).digest("hex"),
 }, scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path15.resolve(root, item);
+    const target = path16.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs12.existsSync(ancestor) && ancestor !== root)
-      ancestor = path15.dirname(ancestor);
+    while (!fs13.existsSync(ancestor) && ancestor !== root)
+      ancestor = path16.dirname(ancestor);
     try {
-      if (!inside(root, fs12.realpathSync(ancestor)))
+      if (!inside(root, fs13.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -15381,7 +15415,7 @@ var digestBytes = (value) => createHash9("sha256").update(value).digest("hex"),
 }, findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId != null), verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
-    root = fs12.realpathSync(checkoutRoot);
+    root = fs13.realpathSync(checkoutRoot);
   } catch {
     return failure2("permission_denied", "checkout root is unavailable");
   }
@@ -15390,23 +15424,23 @@ var digestBytes = (value) => createHash9("sha256").update(value).digest("hex"),
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path15.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path15.sep}`))
+    const target = path16.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path16.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path15.relative(root, target);
+      const below = path16.relative(root, target);
       let current = root;
-      for (const segment of below.split(path15.sep)) {
+      for (const segment of below.split(path16.sep)) {
         if (!segment)
           continue;
-        current = path15.join(current, segment);
-        const stat = fs12.lstatSync(current);
-        const real = fs12.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path15.sep}`))
+        current = path16.join(current, segment);
+        const stat = fs13.lstatSync(current);
+        const real = fs13.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path16.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -15422,7 +15456,7 @@ var digestBytes = (value) => createHash9("sha256").update(value).digest("hex"),
         if (current !== target && !stat.isDirectory())
           return failure2("invalid_input", "document reference ancestor is not a directory");
       }
-      if (digestBytes(fs12.readFileSync(target)) !== reference.digest)
+      if (digestBytes(fs13.readFileSync(target)) !== reference.digest)
         return failure2("permission_denied", "decision document bytes have changed");
     } catch {
       return failure2("invalid_input", "decision document is unavailable");
@@ -15526,7 +15560,8 @@ Autonomy contract:
   satisfies a gate; an ad-hoc \`workit check -- <cmd>\` never does.
 - Author is not verifier: your own verdict is \`--self\`, shown as
   self-reviewed, never verified. High risk, \`verification: independent\` and
-  merge need a verifier with its own session (\`WORKIT_SESSION_ID=<lead>-v<n>\`).
+  merge need a verifier with its own host-derived session (a subagent's
+  \`<lead>:<child>\`, set by the host); never hand-mint one such as \`<lead>-v1\`.
 - A local-commit endpoint does not imply PR readiness, and a local commit alone
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
@@ -17361,9 +17396,9 @@ var support = (descriptor, axis) => {
 });
 // packages/workit-core/src/hooks/context.ts
-import { createHash as createHash10 } from "node:crypto";
-import fs13 from "node:fs";
-import path16 from "node:path";
+import { createHash as createHash11 } from "node:crypto";
+import fs14 from "node:fs";
+import path17 from "node:path";
 function sessionCompactContext(store, session, context, selection = "session-bound") {
   const listed = store.listTaskIndex();
   if (!listed.ok)
@@ -17398,7 +17433,7 @@ function entryCompactContext(store, entry, session, context) {
     return null;
   const freshness = { mode: "signal", current: () => recentSignal(store.root) };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
-  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path16.resolve(store.root, ref.path)] : []));
+  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path17.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
   const compact = new WorkitCore(store, context).compactContext(entry?.id ?? null, freshness, origin && { origin: origin.origin, taskId: origin.entry.id });
   if (!compact.ok || !compact.data)
@@ -17496,7 +17531,7 @@ ${options.addendum}` : ""}
   } catch {
     return null;
   }
-}, TURN_TTL_MS, digestOf = (text) => createHash10("sha256").update(text).digest("hex"), turnMarker = (input) => {
+}, TURN_TTL_MS, digestOf = (text) => createHash11("sha256").update(text).digest("hex"), turnMarker = (input) => {
   if (!input.session.id)
     return null;
   try {
@@ -17504,29 +17539,29 @@ ${options.addendum}` : ""}
     if (location instanceof Error)
       return null;
     const session = [input.host, input.session.id, input.session.agentId ?? ""].join("\x00");
-    return path16.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
+    return path17.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
   } catch {
     return null;
   }
 }, writeTurnDigest = (file, digest) => {
   try {
-    fs13.mkdirSync(path16.dirname(file), { recursive: true });
-    fs13.writeFileSync(file, `${JSON.stringify({ digest })}
+    fs14.mkdirSync(path17.dirname(file), { recursive: true });
+    fs14.writeFileSync(file, `${JSON.stringify({ digest })}
 `);
   } catch {}
 }, clearTurnDigest = (file) => {
   try {
-    fs13.rmSync(file, { force: true });
+    fs14.rmSync(file, { force: true });
   } catch {}
 }, pruneTurnDigests = (dir, now) => {
   try {
-    for (const name of fs13.readdirSync(dir)) {
+    for (const name of fs14.readdirSync(dir)) {
       if (!name.startsWith("turn-"))
         continue;
-      const file = path16.join(dir, name);
+      const file = path17.join(dir, name);
       try {
-        if (now - fs13.statSync(file).mtimeMs > TURN_TTL_MS)
-          fs13.rmSync(file, { force: true });
+        if (now - fs14.statSync(file).mtimeMs > TURN_TTL_MS)
+          fs14.rmSync(file, { force: true });
       } catch {}
     }
   } catch {}
@@ -17541,7 +17576,7 @@ ${options.addendum}` : ""}
     return text;
   const digest = digestOf(text);
   try {
-    const previous = JSON.parse(fs13.readFileSync(file, "utf8"));
+    const previous = JSON.parse(fs14.readFileSync(file, "utf8"));
     if (previous.digest === digest)
       return null;
   } catch {}
@@ -17551,7 +17586,7 @@ ${options.addendum}` : ""}
   const file = turnMarker(input);
   if (!file)
     return;
-  pruneTurnDigests(path16.dirname(file), Date.now());
+  pruneTurnDigests(path17.dirname(file), Date.now());
   if (text)
     writeTurnDigest(file, digestOf(text));
   else
@@ -17577,7 +17612,7 @@ var init_commit_flavors = () => {};
 var init_git = () => {};
 // packages/workit-core/src/core/branch.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
   const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
   const config = readConfig();
@@ -17612,10 +17647,41 @@ var withReleaseTracks = (workspaceRoot, policy) => {
       ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
     ])
   };
+}, KIND_SYNONYMS, allowedKinds = (allowed) => [
+  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
+], editDistance = (a, b) => {
+  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (let i = 1;i <= a.length; i++) {
+    let previous = row[0];
+    row[0] = i;
+    for (let j = 1;j <= b.length; j++) {
+      const saved = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+      previous = saved;
+    }
+  }
+  return row[b.length];
+}, suggestBranchName = (name, kinds) => {
+  if (!kinds.length)
+    return null;
+  const slash = name.indexOf("/");
+  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
+  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
+  const synonym = KIND_SYNONYMS[prefix];
+  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
+  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
+  return `${kind}/${rest}`;
+}, kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", "), aliasNote = (kinds) => {
+  const notes = [
+    ["fix", "bugfix"],
+    ["chore", "feature"]
+  ].filter(([, kind]) => kinds.includes(kind)).map(([alias, kind]) => `${alias}/ is ${kind}/`);
+  return notes.length ? ` (${notes.join(", ")})` : "";
 }, validateBranchNamePolicy = (name, policy, source) => {
   const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
+  const kinds = allowedKinds(policy.allowed);
   if (policy.protected.has(name.toLowerCase())) {
-    const correction = `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
+    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
     return {
       ok: false,
       rule: "protected_ref",
@@ -17626,7 +17692,8 @@ var withReleaseTracks = (workspaceRoot, policy) => {
     };
   }
   if (!policy.allowed.some((pattern) => pattern.test(name))) {
-    const correction = `choose a branch matching one of: ${allowed.join(", ")}`;
+    const suggestion = suggestBranchName(name, kinds);
+    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
     return {
       ok: false,
       rule: "allowed_pattern",
@@ -17643,7 +17710,7 @@ var withReleaseTracks = (workspaceRoot, policy) => {
   const source = resolved.provenance.branchPolicy;
   const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
   const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
-  const fingerprint = createHash11("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
+  const fingerprint = createHash12("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
   return {
     branchPolicy,
     namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
@@ -17665,7 +17732,52 @@ var withReleaseTracks = (workspaceRoot, policy) => {
       error: `policy_unavailable: cannot validate branch ${JSON.stringify(name)} because ${error instanceof Error ? error.message : String(error)}; ${correction}`
     };
   }
-}, resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
+}, resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy, gitFlowOf = (root, integration) => {
+  try {
+    if (resolveBranchPolicyFor(root).preset !== "gitflow")
+      return null;
+    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    const names = branchNames(root);
+    const production = productionBranchOf(names);
+    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
+    return { develop, production, developExists: names.has(develop) };
+  } catch {
+    return null;
+  }
+}, releaseBranchesOf = (cwd) => {
+  try {
+    const resolved = resolveBranchPolicyFor(cwd);
+    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
+    return {
+      preset: resolved.preset,
+      branches: flow ? [flow.production, flow.develop] : [],
+      production: flow ? flow.production : resolved.defaultTargetBranch
+    };
+  } catch {
+    return { preset: "unknown", branches: [], production: null };
+  }
+}, releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase()), branchGuidance = (cwd) => {
+  try {
+    const patterns = branchPolicySnapshotFor(cwd).namePolicy.allowed;
+    const kinds = allowedKinds(patterns);
+    const kindShaped = new Set(kinds.map((kind) => branchGlobPattern(`${kind}/*`).source));
+    const anyName = patterns.some((pattern) => pattern.source === "^.*$");
+    const others = patterns.filter((pattern) => !kindShaped.has(pattern.source)).map((pattern) => globOf(pattern));
+    const allowed = anyName ? "Any non-protected branch name is allowed here." : `${kinds.length ? `Allowed branch kinds here: ${kindList(kinds)}${aliasNote(kinds)}` : "Allowed branch names here:"}${others.length ? `${kinds.length ? "; also" : ""} names matching ${others.join(", ")}` : ""}; anything else is denied.`;
+    const resolved = vcsConfig("resolve", cwd);
+    const integration = resolved.ok === false ? null : String(resolved.defaultTargetBranch ?? "") || null;
+    const flow = resolved.releaseTrack?.track ? null : gitFlowOf(cwd, integration);
+    if (flow?.developExists)
+      return `${allowed} git-flow: feature/, bugfix/ and release/ start from origin/${flow.develop}, hotfix/ from origin/${flow.production}; feature/ and bugfix/ land on ${flow.develop}, release/ and hotfix/ on ${flow.production}.`;
+    const names = branchNames(cwd);
+    const configured = String(resolved.baseBranch ?? integration ?? "") || null;
+    const trunk = productionBranchOf(names);
+    const base = configured && names.has(configured) ? `Branch from origin/${configured}.` : names.has(trunk) ? `Branch from origin/${trunk}${configured ? ` (the default target ${configured} does not exist here)` : ""}.` : "No base branch exists here yet; pass the base explicitly.";
+    return `${allowed} ${base}`;
+  } catch {
+    return null;
+  }
+}, globOf = (pattern) => pattern.source.replace(/^\^|\$$/gu, "").replaceAll(".*", "*").replace(/\\(.)/gu, "$1");
 var init_branch = __esm(() => {
   init_branch_policy();
   init_commit_flavors();
@@ -17674,33 +17786,63 @@ var init_branch = __esm(() => {
   init_workspaces();
   init_vcs_config();
   init_release_tracks();
+  KIND_SYNONYMS = {
+    fix: "bugfix",
+    fixes: "bugfix",
+    bug: "bugfix",
+    bugs: "bugfix",
+    bugfixes: "bugfix",
+    feat: "feature",
+    features: "feature",
+    chore: "feature",
+    docs: "feature",
+    doc: "feature",
+    refactor: "feature",
+    test: "feature",
+    tests: "feature",
+    ci: "feature",
+    build: "feature",
+    perf: "feature",
+    style: "feature",
+    deps: "feature",
+    task: "feature",
+    enhancement: "feature",
+    hot: "hotfix",
+    hotfixes: "hotfix",
+    releases: "release",
+    rel: "release"
+  };
 });
-// packages/workit-core/src/core/route-intent.ts
-var shellBranchTarget = (command) => {
-  if (!command.trim() || /[\r\n;&|<>`'"$()\\*?{}~!#]/u.test(command) || command.includes("[") || command.includes("]"))
-    return null;
-  const args = command.trim().split(/\s+/u);
-  if (args[0] !== "git")
-    return null;
-  const option = args[2];
-  const target = args[1] === "switch" && ["-c", "--create", "-C", "--force-create"].includes(option ?? "") && (args.length === 4 || args.length === 5) ? args[3] : args[1] === "checkout" && ["-b", "-B"].includes(option ?? "") && (args.length === 4 || args.length === 5) ? args[3] : args[1] === "branch" && (args.length === 3 || args.length === 4) ? args[2] : null;
-  return target && !target.startsWith("-") ? target : null;
-}, shellBranchPolicyViolation = (root, command) => {
-  const target = shellBranchTarget(command);
-  return target === null ? null : validateBranchNameFor(root, target);
-};
-var init_route_intent = __esm(() => {
-  init_branch();
-});
-// packages/workit-core/src/hooks/policy.ts
-var shellPolicy = (cwd, command) => {
-  const policy = shellBranchPolicyViolation(cwd, command);
-  return policy && !policy.ok ? { kind: "deny", reason: `branch_policy_denied: ${policy.error}`, unblock: null } : { kind: "none" };
+// packages/workit-core/src/hooks/session-marker.ts
+import { createHash as createHash13 } from "node:crypto";
+import fs15 from "node:fs";
+import path18 from "node:path";
+var sessionMarkerFile = (input, session, store) => {
+  let dir = store;
+  if (dir === undefined) {
+    const location = resolveStore(input.cwd);
+    if (location instanceof Error || !location.shared)
+      return null;
+    dir = location.dir;
+  }
+  const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
+  return path18.join(dir, "hooks", `skills-${name}.json`);
+}, list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [], readSessionMarker = (file) => {
+  try {
+    const value = JSON.parse(fs15.readFileSync(file, "utf8"));
+    return { nudged: list2(value.nudged), loaded: list2(value.loaded), raw: list2(value.raw) };
+  } catch {
+    return { nudged: [], loaded: [], raw: [] };
+  }
+}, writeSessionMarker = (file, marker) => {
+  try {
+    fs15.mkdirSync(path18.dirname(file), { recursive: true });
+    fs15.writeFileSync(file, JSON.stringify(marker));
+  } catch {}
 };
-var init_policy = __esm(() => {
-  init_route_intent();
+var init_session_marker = __esm(() => {
+  init_paths();
 });
 // packages/workit-core/src/hooks/shell-words.ts
@@ -17824,234 +17966,27 @@ var closingQuote = (command, start, dialect) => {
   return segments;
 };
-// packages/workit-core/src/hooks/write-gate.ts
-import { realpathSync as realpathSync5 } from "node:fs";
-import path17 from "node:path";
-function writeGate(cwd, paths) {
-  try {
-    const gate = gateFor(cwd);
-    if (!gate || gate.blockers.length === 0)
-      return NONE2;
-    if (paths?.length && paths.every((file) => exempt(cwd, gate.root, file, gate.plans)))
-      return NONE2;
-    const reasons = gate.blockers.map((item) => `${item.ruleId}: ${item.reason}`).join("; ");
-    return {
-      kind: "deny",
-      reason: `workit before-write gate: ${reasons}. Markdown, docs/, plans/ and files outside the checkout stay writable.`,
-      unblock: gate.blockers[0].reason
-    };
-  } catch {
-    return NONE2;
-  }
-}
-var NONE2, CASE_INSENSITIVE, canonical2 = (file) => {
-  let rest = "";
-  for (let dir = path17.resolve(file);; dir = path17.dirname(dir)) {
-    try {
-      return path17.join(realpathSync5(dir), rest);
-    } catch {
-      if (path17.dirname(dir) === dir)
-        return path17.resolve(file);
-      rest = rest ? path17.join(path17.basename(dir), rest) : path17.basename(dir);
-    }
-  }
-}, exempt = (cwd, root, file, plans) => {
-  const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path17.relative(fold(canonical2(root)), fold(canonical2(path17.resolve(cwd, file))));
-  if (relative.startsWith("..") || path17.isAbsolute(relative))
-    return true;
-  const posix = relative.split(path17.sep).join("/");
-  const segments = posix.split("/");
-  return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
-}, PREFIXES2, operands = (words) => words.filter((item) => !item.startsWith("-")), editsOf = (input) => {
-  let words = input;
-  while (words.length && (PREFIXES2.has(words[0]) || /^\w+=/.test(words[0])))
-    words = words.slice(1);
-  const [verb, ...args] = words;
-  const name = (verb?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
-  if (!name || name === "workit" || name === "npx" && args.some((item) => /workit/.test(item)))
-    return [];
-  switch (name) {
-    case "touch":
-    case "mkdir":
-    case "rm":
-    case "rmdir":
-    case "tee":
-    case "mv":
-    case "truncate":
-      return operands(args);
-    case "cp":
-    case "ln":
-    case "install": {
-      const target = args.indexOf("-t");
-      if (target >= 0)
-        return args[target + 1] ? [args[target + 1]] : null;
-      const last = operands(args).at(-1);
-      return last ? [last] : null;
+// packages/workit-core/src/hooks/raw-git.ts
+import { spawnSync as spawnSync11 } from "node:child_process";
+import { createHash as createHash14 } from "node:crypto";
+import fs16 from "node:fs";
+import os4 from "node:os";
+import path19 from "node:path";
+function rawInvocations(command, dialect = "posix", depth = 0) {
+  const found = [];
+  let dir = null;
+  const groups = [];
+  let stack = [];
+  for (const segment of segmentsOf(command, dialect)) {
+    if (segment.group === "open") {
+      groups.push({ dir, stack: [...stack] });
+      continue;
     }
-    case "dd":
-      return args.filter((item) => item.startsWith("of=")).map((item) => item.slice(3));
-    case "sed":
-    case "perl": {
-      if (!args.some((item) => /^-[a-zA-Z]*i|^--in-place/.test(item)))
-        return [];
-      const scripted = args.some((item) => item === "-e" || item === "-f");
-      const files = [];
-      for (let index = 0;index < args.length; index++) {
-        if (args[index] === "-e" || args[index] === "-f")
-          index++;
-        else if (!args[index].startsWith("-"))
-          files.push(args[index]);
-      }
-      return scripted ? files : files.slice(1);
-    }
-    case "patch":
-      return null;
-    case "set-content":
-    case "add-content":
-    case "out-file":
-    case "new-item":
-    case "ni":
-    case "remove-item":
-    case "del":
-    case "copy-item":
-    case "move-item": {
-      const flag = args.findIndex((item) => /^-(?:path|filepath|literalpath|destination)$/i.test(item));
-      if (flag >= 0)
-        return args[flag + 1] ? [args[flag + 1]] : null;
-      const files = operands(args);
-      if (name === "move-item")
-        return files.length ? files : null;
-      const file = name === "copy-item" ? files.at(-1) : files[0];
-      return file ? [file] : null;
-    }
-    case "git": {
-      const sub = operands(args)[0];
-      if (sub === "apply")
-        return null;
-      if (sub === "restore" || sub === "mv" || sub === "rm")
-        return operands(args).slice(1);
-      if (sub === "checkout" && args.includes("--"))
-        return args.slice(args.indexOf("--") + 1);
-      return [];
-    }
-    default:
-      return [];
-  }
-}, shellWrites = (command) => {
-  const targets = [];
-  let unknown = false;
-  for (const segment of segmentsOf(command)) {
-    targets.push(...segment.redirects.filter((item) => !/^\/dev\/(?:null|stdout|stderr|tty)$/.test(item)));
-    const edits = editsOf(segment.words);
-    if (edits === null)
-      unknown = true;
-    else
-      targets.push(...edits);
-  }
-  if (!unknown && targets.length === 0)
-    return { writes: false, targets: null };
-  return { writes: true, targets: unknown ? null : targets };
-}, cache2, planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path17.resolve(root, file)) ?? "-").join("\x00"), gateFor = (cwd) => {
-  const store = new TaskStore(cwd);
-  const listed = store.listTaskIndex();
-  if (!listed.ok)
-    return null;
-  const key = store.currentKey();
-  if (!key.ok)
-    return null;
-  const entry = listed.data.filter((item) => item.key === key.data.key && item.status !== "closed").toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
-  if (!entry)
-    return { blockers: [], root: store.root, plans: new Set };
-  const ledger = ledgerPath(store.root);
-  const cacheKey = `${entry.id}\x00${entry.revision}\x00${ledger.ok && fileSignature(ledger.value) || "-"}`;
-  const hit = cache2.get(store.root);
-  if (hit && hit.key === cacheKey && hit.planKey === planKeyOf(store.root, hit.plans))
-    return hit;
-  const task = store.readTask(entry.id);
-  if (!task.ok)
-    return null;
-  const workspace = store.readWorkspace();
-  const plans = new Set((latestJudgment(task.data)?.refs ?? []).flatMap((ref) => ref.kind === "file" ? [ref.path] : []));
-  const blockers = writeBlockers(task.data, store.root).filter((blocker) => {
-    const requirement = task.data.policy?.requirements.find((item) => item.ruleId === blocker.ruleId && item.before === "write");
-    return !(requirement?.acceptanceAllowed && workspace.ok && workspace.data && applicableDecision(task.data, workspace.data, requirement, store.root).length > 0);
-  });
-  const gate = {
-    blockers,
-    root: store.root,
-    plans,
-    key: cacheKey,
-    planKey: planKeyOf(store.root, plans)
-  };
-  cache2.set(store.root, gate);
-  if (cache2.size > 32)
-    cache2.delete(cache2.keys().next().value);
-  return gate;
-};
-var init_write_gate = __esm(() => {
-  init_task_store();
-  init_derive();
-  init_task_evaluation();
-  init_ledger();
-  NONE2 = { kind: "none" };
-  CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
-  PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
-  cache2 = new Map;
-});
-// packages/workit-core/src/hooks/session-marker.ts
-import { createHash as createHash12 } from "node:crypto";
-import fs14 from "node:fs";
-import path18 from "node:path";
-var sessionMarkerFile = (input, session, store) => {
-  let dir = store;
-  if (dir === undefined) {
-    const location = resolveStore(input.cwd);
-    if (location instanceof Error || !location.shared)
-      return null;
-    dir = location.dir;
-  }
-  const name = createHash12("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
-  return path18.join(dir, "hooks", `skills-${name}.json`);
-}, list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [], readSessionMarker = (file) => {
-  try {
-    const value = JSON.parse(fs14.readFileSync(file, "utf8"));
-    return { nudged: list2(value.nudged), loaded: list2(value.loaded), raw: list2(value.raw) };
-  } catch {
-    return { nudged: [], loaded: [], raw: [] };
-  }
-}, writeSessionMarker = (file, marker) => {
-  try {
-    fs14.mkdirSync(path18.dirname(file), { recursive: true });
-    fs14.writeFileSync(file, JSON.stringify(marker));
-  } catch {}
-};
-var init_session_marker = __esm(() => {
-  init_paths();
-});
-// packages/workit-core/src/hooks/raw-git.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
-import { createHash as createHash13 } from "node:crypto";
-import fs15 from "node:fs";
-import os4 from "node:os";
-import path19 from "node:path";
-function rawInvocations(command, dialect = "posix", depth = 0) {
-  const found = [];
-  let dir = null;
-  const groups = [];
-  let stack = [];
-  for (const segment of segmentsOf(command, dialect)) {
-    if (segment.group === "open") {
-      groups.push({ dir, stack: [...stack] });
-      continue;
-    }
-    if (segment.group === "close") {
-      const saved = groups.pop();
-      if (saved)
-        ({ dir, stack } = saved);
-      continue;
+    if (segment.group === "close") {
+      const saved = groups.pop();
+      if (saved)
+        ({ dir, stack } = saved);
+      continue;
     }
     const words = stripPrefixes(segment.words);
     const name = commandName(words[0]);
@@ -18146,7 +18081,7 @@ function rawAction(invocation) {
 function rawGitPre(input, command, options = {}) {
   try {
     if (!mentionsRawTool(command))
-      return NONE3;
+      return NONE2;
     const dialect = dialectOf(input);
     const nudges = new Map;
     let store = null;
@@ -18154,25 +18089,36 @@ function rawGitPre(input, command, options = {}) {
       store ??= repo.location.dir;
       if (action.kind === "merge")
         return deny(refusal(action, null));
-      if (action.kind === "push")
+      if (action.kind === "push" && toPushRemote(repo, action.remote)) {
+        if (action.mirror)
+          return deny(`workit: raw ${quote("git push --mirror")} rewrites and deletes every remote ref, protected branches and tags included. Push one branch with ${quote("workit git push")}.`);
         for (const target of action.targets) {
           const branch = target ?? repo.branch;
-          if (branch && guardedBranch(repo.dir, branch) && toPushRemote(repo, action.remote))
-            return deny(refusal(action, branch));
+          if (branch && guardedBranch(repo.dir, branch))
+            return deny(refusal(action, branch, repo.dir));
         }
+        const remote = action.remote ?? pushRemoteName(repo.dir, repo.branch) ?? "origin";
+        const facts = refFacts(repo, remote);
+        const tagDeny = tagRefusal(action, facts);
+        if (tagDeny)
+          return deny(tagDeny);
+        const nameDeny = action.deletes ? null : offPolicyPush(action, repo, facts, remote);
+        if (nameDeny)
+          return deny(nameDeny);
+      }
       const nudge = nudgeFor(action, input.host, input.session.id);
       if (nudge && !nudges.has(nudgeKind(action)))
         nudges.set(nudgeKind(action), nudge);
     }
     if (options.nudge === false || !store || nudges.size === 0)
-      return NONE3;
+      return NONE2;
     if (workitInvocations(command, dialect).length > 0)
-      return NONE3;
+      return NONE2;
     const shown = unseenNudges(input, nudges, store);
     return shown.length ? { kind: "context", text: shown.join(`
-`) } : NONE3;
+`) } : NONE2;
   } catch {
-    return NONE3;
+    return NONE2;
   }
 }
 function noteRawCommit(input, command, key) {
@@ -18184,8 +18130,8 @@ function noteRawCommit(input, command, key) {
       if (action.kind !== "commit")
         continue;
       const file = markerFile(repo, input.session.id, key);
-      fs15.mkdirSync(path19.dirname(file), { recursive: true });
-      fs15.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
+      fs16.mkdirSync(path19.dirname(file), { recursive: true });
+      fs16.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
 `);
     }
   } catch {}
@@ -18207,11 +18153,11 @@ function settlePendingCommit(input) {
     if (!repo)
       return;
     const file = markerFile(repo, input.session.id, NEXT_COMMAND);
-    if (fs15.existsSync(file))
+    if (fs16.existsSync(file))
       settle2(input, repo, file);
   } catch {}
 }
-var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, isAbsolute = (value) => path19.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\"), joinDir = (base, next) => {
+var NONE2, SHELLS, PREFIXES2, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, isAbsolute = (value) => path19.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\"), joinDir = (base, next) => {
   if (base === undefined || /[$`*?]/.test(next) || next === "-")
     return;
   const expanded = next === "~" || next.startsWith("~/") ? path19.join(os4.homedir(), next.slice(1)) : next;
@@ -18230,7 +18176,7 @@ var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, i
       return words;
     if (/^\w+=/.test(first))
       words = words.slice(1);
-    else if (PREFIXES3.has(first)) {
+    else if (PREFIXES2.has(first)) {
       words = words.slice(1);
       while (words[0]?.startsWith("-"))
         words = words.slice(words[0] === "-u" ? 2 : 1);
@@ -18246,6 +18192,10 @@ var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, i
   let force = false;
   let lease = false;
   let wholesale = false;
+  let allTags = false;
+  let deletes = false;
+  let allBranches = false;
+  let mirror = false;
   let remote = null;
   const positionals = [];
   for (let index = 1;index < args.length; index++) {
@@ -18266,14 +18216,22 @@ var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, i
       force = true;
     else if (arg.startsWith("--force-with-lease") || arg === "--force-if-includes")
       lease = true;
-    else if (["--all", "--mirror", "--branches", "--tags"].includes(arg))
-      wholesale = true;
+    else if (arg === "--delete" || arg === "-d")
+      deletes = true;
+    else if (arg === "--tags")
+      allTags = wholesale = true;
+    else if (arg === "--all" || arg === "--branches")
+      allBranches = wholesale = true;
+    else if (arg === "--mirror")
+      mirror = wholesale = true;
     else if (!arg.startsWith("-"))
       positionals.push(arg);
   }
   const specs = remote === null ? positionals.slice(1) : positionals;
   remote ??= positionals[0] ?? null;
   const targets = [];
+  const tags = [];
+  const deleted = [];
   for (const raw of specs) {
     if (raw.startsWith("+"))
       force = true;
@@ -18282,16 +18240,29 @@ var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, i
     const destination = colon >= 0 ? spec.slice(colon + 1) : spec;
     if (!destination)
       continue;
-    if (destination === "HEAD")
-      targets.push(null);
-    else if (destination.startsWith("refs/heads/"))
-      targets.push(destination.slice(11));
-    else if (!destination.startsWith("refs/"))
-      targets.push(destination);
+    const name = destination === "HEAD" ? null : destination.startsWith("refs/heads/") ? destination.slice(11) : destination.startsWith("refs/") ? undefined : destination;
+    if (destination.startsWith("refs/tags/"))
+      tags.push(destination.slice(10));
+    if (name === undefined)
+      continue;
+    targets.push(name);
+    if (colon === 0 && name !== null)
+      deleted.push(name);
   }
   if (specs.length === 0 && !wholesale)
     targets.push(null);
-  return { kind: "push", targets, blindForce: force && !lease, remote };
+  return {
+    kind: "push",
+    targets,
+    blindForce: force && !lease,
+    remote,
+    ...tags.length ? { tags } : {},
+    ...allTags ? { allTags: true } : {},
+    ...deletes ? { deletes: true } : {},
+    ...deleted.length ? { deleted } : {},
+    ...allBranches ? { allBranches: true } : {},
+    ...mirror ? { mirror: true } : {}
+  };
 }, VALUE_OPTIONS, asksHelp = (invocation) => {
   const { tool, args } = invocation;
   if (args[0] === "help" || tool !== "git" && args[1] === "help")
@@ -18313,7 +18284,7 @@ var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, i
     return null;
   return { location, dir, branch: resolveTaskKey(dir, location).branch };
 }, isWorkitWorkspace = (repo) => {
-  if (fs15.existsSync(repo.location.dir))
+  if (fs16.existsSync(repo.location.dir))
     return true;
   try {
     return resolveRuntimeWorkspaceVcs(repo.location.top ?? repo.dir) !== null;
@@ -18341,7 +18312,7 @@ var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, i
   if (!git || git.reftable)
     return null;
   try {
-    const head = fs15.readFileSync(path19.join(git.gitDir, "HEAD"), "utf8").trim();
+    const head = fs16.readFileSync(path19.join(git.gitDir, "HEAD"), "utf8").trim();
     if (/^[0-9a-f]{40,64}$/.test(head))
       return head;
     const ref = /^ref: (refs\/.+)$/.exec(head)?.[1];
@@ -18349,17 +18320,64 @@ var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, i
       return null;
     const common = path19.dirname(repo.location.dir);
     try {
-      return fs15.readFileSync(path19.join(common, ref), "utf8").trim() || null;
+      return fs16.readFileSync(path19.join(common, ref), "utf8").trim() || null;
     } catch {}
-    const packed = fs15.readFileSync(path19.join(common, "packed-refs"), "utf8");
+    const packed = fs16.readFileSync(path19.join(common, "packed-refs"), "utf8");
     return new RegExp(`^([0-9a-f]{40,64}) ${ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m").exec(packed)?.[1] ?? null;
   } catch {
     return null;
   }
-}, quote = (text) => `\`${text}\``, refusal = (action, branch) => {
+}, quote = (text) => `\`${text}\``, refusal = (action, branch, dir) => {
   if (action.kind === "merge")
     return `workit: raw ${quote(action.forge === "gh" ? "gh pr merge" : "glab mr merge")} bypasses the merge grant and the verdict gate. Run ${quote("workit pr merge")} instead (it checks both; ${quote("workit help pr")}).`;
+  const plainPush = action.kind === "push" && !action.blindForce && !action.deletes;
+  if (dir && branch && plainPush && releaseBranch(dir, branch))
+    return `workit: raw ${quote("git push")} onto ${branch}, a protected release branch, bypasses workit's protected-branch check. To finish a release or hotfix, push it with ${quote(`workit git push --release ${branch} [--release v<version>]`)}: it pushes ${branch} (fast-forward only) and the release tag, verifies the remote and records it, under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}). Feature work goes through ${quote("workit git push")} and ${quote("workit pr merge")}.`;
   return `workit: raw ${quote("git push")}${action.kind === "push" && action.blindForce ? " --force" : ""} onto ${branch}, a protected branch or the default target, bypasses workit's protected-branch check. Push your feature branch with ${quote("workit git push")} (${quote("workit git push --force-with-lease")} to rewrite it) and land it with ${quote("workit pr merge")}.`;
+}, refFacts = (repo, remote) => {
+  const facts = { heads: new Set, tags: new Set, remoteHeads: new Set };
+  const listed = spawnSync11("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/tags", `refs/remotes/${remote}`], { cwd: repo.dir, encoding: "utf8", timeout: 5000 });
+  const remotePrefix = `refs/remotes/${remote}/`;
+  for (const ref of (listed.stdout ?? "").split(`
+`)) {
+    if (ref.startsWith("refs/heads/"))
+      facts.heads.add(ref.slice(11));
+    else if (ref.startsWith("refs/tags/"))
+      facts.tags.add(ref.slice(10));
+    else if (ref.startsWith(remotePrefix))
+      facts.remoteHeads.add(ref.slice(remotePrefix.length));
+  }
+  return facts;
+}, isTag = (facts, name) => facts.tags.has(name) && !facts.heads.has(name), tagRefusal = (action, facts) => {
+  const tags = [
+    ...action.tags ?? [],
+    ...action.targets.filter((name) => name !== null && isTag(facts, name))
+  ];
+  if (!tags.length && !action.allTags)
+    return null;
+  const named = tags.length ? tags.join(" --release ") : "v<version>";
+  return `workit: raw ${quote(`git push${action.allTags ? " --tags" : ""}`)} of ${tags.length ? `tag ${tags.join(", ")}` : "tags"} bypasses the release grant. Push a release tag with ${quote(`workit git push --release ${named}`)} (v<version> tags whose commit the production branch already has; a tag never moves), under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}).`;
+}, remoteHas = (repo, remote, branch) => {
+  const listed = spawnSync11("git", ["ls-remote", "--heads", remote, `refs/heads/${branch}`], {
+    cwd: repo.dir,
+    encoding: "utf8",
+    timeout: 3000,
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+  return listed.status !== 0 || (listed.stdout ?? "").trim() !== "";
+}, offPolicyPush = (action, repo, facts, remote) => {
+  const names = action.allBranches ? [...facts.heads] : action.targets.map((target) => target ?? repo.branch);
+  for (const branch of names) {
+    if (!branch || action.deleted?.includes(branch) || isTag(facts, branch))
+      continue;
+    if (facts.remoteHeads.has(branch))
+      continue;
+    const check = validateBranchNameFor(repo.dir, branch);
+    if (check.ok || check.rule !== "allowed_pattern" || remoteHas(repo, remote, branch))
+      continue;
+    return `workit: raw ${quote("git push")} onto ${branch}: ${check.error}`;
+  }
+  return null;
 }, nudgeFor = (action, host, session) => {
   switch (action.kind) {
     case "commit": {
@@ -18411,7 +18429,7 @@ var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, i
       raw: [...marker.raw, ...fresh.map((kind) => agent + kind)]
     });
   return fresh.map((kind) => nudges.get(kind));
-}, deny = (reason) => ({ kind: "deny", reason, unblock: null }), NEXT_COMMAND = "next", MARKER_TTL_SECONDS = 3600, markerFile = (repo, session, key) => path19.join(repo.location.dir, "hooks", `commit-${createHash13("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`), callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash13("sha256").update(command).digest("hex")}`, headCommit = (dir) => {
+}, deny = (reason) => ({ kind: "deny", reason, unblock: null }), NEXT_COMMAND = "next", MARKER_TTL_SECONDS = 3600, markerFile = (repo, session, key) => path19.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`), callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash14("sha256").update(command).digest("hex")}`, headCommit = (dir) => {
   const run = spawnSync11("git", [
     "log",
     "-1",
@@ -18428,11 +18446,11 @@ var NONE3, SHELLS, PREFIXES3, SCRIPT_FLAG, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, i
 }, settle2 = (input, repo, file) => {
   let marker;
   try {
-    marker = JSON.parse(fs15.readFileSync(file, "utf8"));
+    marker = JSON.parse(fs16.readFileSync(file, "utf8"));
   } catch {
     return;
   }
-  fs15.rmSync(file, { force: true });
+  fs16.rmSync(file, { force: true });
   const session = input.session.id;
   const now = Date.now() / 1000;
   if (typeof marker.at !== "number" || now - marker.at > MARKER_TTL_SECONDS)
@@ -18471,9 +18489,9 @@ var init_raw_git = __esm(() => {
   init_ledger();
   init_paths();
   init_session_marker();
-  NONE3 = { kind: "none" };
+  NONE2 = { kind: "none" };
   SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
-  PREFIXES3 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "nice", "&"]);
+  PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "nice", "&"]);
   SCRIPT_FLAG = /^-[a-zA-Z]*c[a-zA-Z]*$/;
   CD = new Set(["cd", "chdir", "set-location", "sl"]);
   PUSHD = new Set(["pushd", "push-location"]);
@@ -18531,8 +18549,298 @@ var init_raw_git = __esm(() => {
   };
 });
-// packages/workit-core/src/hooks/stop.ts
+// packages/workit-core/src/core/route-intent.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
+import { existsSync as existsSync6 } from "node:fs";
+import path20 from "node:path";
+var UNKNOWABLE, SWITCH_CREATE, CHECKOUT_CREATE, WORKTREE_CREATE, BRANCH_NO_CREATE, BRANCH_RENAME, flagValue = (args, flags) => {
+  for (let index = 1;index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--")
+      return null;
+    if (flags.has(arg))
+      return args[index + 1] ?? null;
+    const eq = arg.indexOf("=");
+    if (arg.startsWith("--") && eq > 0 && flags.has(arg.slice(0, eq)))
+      return arg.slice(eq + 1);
+    if (!arg.startsWith("--") && arg.length > 2 && flags.has(arg.slice(0, 2)))
+      return arg.slice(2);
+  }
+  return null;
+}, WORKTREE_VALUES, worktreeTarget = (args) => {
+  const named = flagValue(args, WORKTREE_CREATE);
+  if (named !== null)
+    return named;
+  const positionals = [];
+  for (let index = 1;index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--detach" || arg === "-d")
+      return null;
+    if (WORKTREE_VALUES.has(arg))
+      index++;
+    else if (!arg.startsWith("-"))
+      positionals.push(arg);
+  }
+  if (positionals.length !== 1)
+    return null;
+  const base = positionals[0].split(/[\\/]/u).findLast(Boolean) ?? "";
+  return base && base !== "." && base !== ".." ? base : null;
+}, branchCommandTarget = (args) => {
+  let rename = false;
+  const positionals = [];
+  for (let index = 1;index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--") {
+      positionals.push(...args.slice(index + 1));
+      break;
+    }
+    const flag = arg.split("=", 1)[0];
+    if (BRANCH_NO_CREATE.has(flag))
+      return null;
+    if (BRANCH_RENAME.has(flag))
+      rename = true;
+    else if (!arg.startsWith("-"))
+      positionals.push(arg);
+  }
+  if (positionals.length < 1 || positionals.length > 2)
+    return null;
+  return rename ? positionals.at(-1) ?? null : positionals[0];
+}, gitBranchCreation = (args) => {
+  const [sub, second] = args;
+  const target = sub === "switch" ? flagValue(args, SWITCH_CREATE) : sub === "checkout" ? flagValue(args, CHECKOUT_CREATE) : sub === "branch" ? branchCommandTarget(args) : sub === "worktree" && second === "add" ? worktreeTarget(args.slice(1)) : null;
+  return target && !target.startsWith("-") && !UNKNOWABLE.test(target) ? target : null;
+}, shellBranchTargets = (command, dialect = "posix") => {
+  if (!/\bgit\b/u.test(command))
+    return [];
+  const found = [];
+  for (const invocation of rawInvocations(command, dialect)) {
+    if (invocation.tool !== "git")
+      continue;
+    const branch = gitBranchCreation(invocation.args);
+    if (branch)
+      found.push({ branch, dir: invocation.dir });
+  }
+  return found;
+}, localBranchExists = (dir, branch) => spawnSync12("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], {
+  cwd: dir,
+  stdio: "ignore",
+  timeout: 5000
+}).status === 0, shellBranchPolicyViolation = (root, command, dialect = "posix") => {
+  let judged = false;
+  for (const target of shellBranchTargets(command, dialect)) {
+    if (target.dir === undefined)
+      continue;
+    const dir = target.dir === null ? root : path20.resolve(root, target.dir);
+    if (target.dir !== null && (!existsSync6(dir) || !inWorkitWorkspace(dir)))
+      continue;
+    if (localBranchExists(dir, target.branch))
+      continue;
+    judged = true;
+    const check = validateBranchNameFor(dir, target.branch);
+    if (!check.ok)
+      return check;
+  }
+  return judged ? { ok: true } : null;
+};
+var init_route_intent = __esm(() => {
+  init_raw_git();
+  init_branch();
+  UNKNOWABLE = /[$`*?[\]{}~]/u;
+  SWITCH_CREATE = new Set(["-c", "--create", "-C", "--force-create", "--orphan"]);
+  CHECKOUT_CREATE = new Set(["-b", "-B", "--orphan"]);
+  WORKTREE_CREATE = new Set(["-b", "-B"]);
+  BRANCH_NO_CREATE = new Set(["-d", "-D", "--delete", "-l", "--list", "-a", "--all", "-r", "--remotes", "--show-current"].concat(["-v", "-vv", "--verbose", "--contains", "--no-contains", "--merged", "--no-merged"]).concat(["--points-at", "--sort", "--format", "--column", "--no-column", "-u"]).concat(["--set-upstream-to", "--unset-upstream", "--edit-description", "-i", "--ignore-case"]));
+  BRANCH_RENAME = new Set(["-m", "-M", "--move", "-c", "-C", "--copy"]);
+  WORKTREE_VALUES = new Set(["--reason"]);
+});
+// packages/workit-core/src/hooks/policy.ts
+var shellPolicy = (cwd, command, dialect = "posix") => {
+  const policy = shellBranchPolicyViolation(cwd, command, dialect);
+  return policy && !policy.ok ? { kind: "deny", reason: `branch_policy_denied: ${policy.error}`, unblock: null } : { kind: "none" };
+};
+var init_policy = __esm(() => {
+  init_route_intent();
+});
+// packages/workit-core/src/hooks/write-gate.ts
+import { realpathSync as realpathSync5 } from "node:fs";
+import path21 from "node:path";
+function writeGate(cwd, paths) {
+  try {
+    const gate = gateFor(cwd);
+    if (!gate || gate.blockers.length === 0)
+      return NONE3;
+    if (paths?.length && paths.every((file) => exempt(cwd, gate.root, file, gate.plans)))
+      return NONE3;
+    const reasons = gate.blockers.map((item) => `${item.ruleId}: ${item.reason}`).join("; ");
+    return {
+      kind: "deny",
+      reason: `workit before-write gate: ${reasons}. Markdown, docs/, plans/ and files outside the checkout stay writable.`,
+      unblock: gate.blockers[0].reason
+    };
+  } catch {
+    return NONE3;
+  }
+}
+var NONE3, CASE_INSENSITIVE, canonical2 = (file) => {
+  let rest = "";
+  for (let dir = path21.resolve(file);; dir = path21.dirname(dir)) {
+    try {
+      return path21.join(realpathSync5(dir), rest);
+    } catch {
+      if (path21.dirname(dir) === dir)
+        return path21.resolve(file);
+      rest = rest ? path21.join(path21.basename(dir), rest) : path21.basename(dir);
+    }
+  }
+}, exempt = (cwd, root, file, plans) => {
+  const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
+  const relative = path21.relative(fold(canonical2(root)), fold(canonical2(path21.resolve(cwd, file))));
+  if (relative.startsWith("..") || path21.isAbsolute(relative))
+    return true;
+  const posix = relative.split(path21.sep).join("/");
+  const segments = posix.split("/");
+  return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
+}, PREFIXES3, operands = (words) => words.filter((item) => !item.startsWith("-")), editsOf = (input) => {
+  let words = input;
+  while (words.length && (PREFIXES3.has(words[0]) || /^\w+=/.test(words[0])))
+    words = words.slice(1);
+  const [verb, ...args] = words;
+  const name = (verb?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+  if (!name || name === "workit" || name === "npx" && args.some((item) => /workit/.test(item)))
+    return [];
+  switch (name) {
+    case "touch":
+    case "mkdir":
+    case "rm":
+    case "rmdir":
+    case "tee":
+    case "mv":
+    case "truncate":
+      return operands(args);
+    case "cp":
+    case "ln":
+    case "install": {
+      const target = args.indexOf("-t");
+      if (target >= 0)
+        return args[target + 1] ? [args[target + 1]] : null;
+      const last = operands(args).at(-1);
+      return last ? [last] : null;
+    }
+    case "dd":
+      return args.filter((item) => item.startsWith("of=")).map((item) => item.slice(3));
+    case "sed":
+    case "perl": {
+      if (!args.some((item) => /^-[a-zA-Z]*i|^--in-place/.test(item)))
+        return [];
+      const scripted = args.some((item) => item === "-e" || item === "-f");
+      const files = [];
+      for (let index = 0;index < args.length; index++) {
+        if (args[index] === "-e" || args[index] === "-f")
+          index++;
+        else if (!args[index].startsWith("-"))
+          files.push(args[index]);
+      }
+      return scripted ? files : files.slice(1);
+    }
+    case "patch":
+      return null;
+    case "set-content":
+    case "add-content":
+    case "out-file":
+    case "new-item":
+    case "ni":
+    case "remove-item":
+    case "del":
+    case "copy-item":
+    case "move-item": {
+      const flag = args.findIndex((item) => /^-(?:path|filepath|literalpath|destination)$/i.test(item));
+      if (flag >= 0)
+        return args[flag + 1] ? [args[flag + 1]] : null;
+      const files = operands(args);
+      if (name === "move-item")
+        return files.length ? files : null;
+      const file = name === "copy-item" ? files.at(-1) : files[0];
+      return file ? [file] : null;
+    }
+    case "git": {
+      const sub = operands(args)[0];
+      if (sub === "apply")
+        return null;
+      if (sub === "restore" || sub === "mv" || sub === "rm")
+        return operands(args).slice(1);
+      if (sub === "checkout" && args.includes("--"))
+        return args.slice(args.indexOf("--") + 1);
+      return [];
+    }
+    default:
+      return [];
+  }
+}, shellWrites = (command) => {
+  const targets = [];
+  let unknown = false;
+  for (const segment of segmentsOf(command)) {
+    targets.push(...segment.redirects.filter((item) => !/^\/dev\/(?:null|stdout|stderr|tty)$/.test(item)));
+    const edits = editsOf(segment.words);
+    if (edits === null)
+      unknown = true;
+    else
+      targets.push(...edits);
+  }
+  if (!unknown && targets.length === 0)
+    return { writes: false, targets: null };
+  return { writes: true, targets: unknown ? null : targets };
+}, cache2, planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path21.resolve(root, file)) ?? "-").join("\x00"), gateFor = (cwd) => {
+  const store = new TaskStore(cwd);
+  const listed = store.listTaskIndex();
+  if (!listed.ok)
+    return null;
+  const key = store.currentKey();
+  if (!key.ok)
+    return null;
+  const entry = listed.data.filter((item) => item.key === key.data.key && item.status !== "closed").toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
+  if (!entry)
+    return { blockers: [], root: store.root, plans: new Set };
+  const ledger = ledgerPath(store.root);
+  const cacheKey = `${entry.id}\x00${entry.revision}\x00${ledger.ok && fileSignature(ledger.value) || "-"}`;
+  const hit = cache2.get(store.root);
+  if (hit && hit.key === cacheKey && hit.planKey === planKeyOf(store.root, hit.plans))
+    return hit;
+  const task = store.readTask(entry.id);
+  if (!task.ok)
+    return null;
+  const workspace = store.readWorkspace();
+  const plans = new Set((latestJudgment(task.data)?.refs ?? []).flatMap((ref) => ref.kind === "file" ? [ref.path] : []));
+  const blockers = writeBlockers(task.data, store.root).filter((blocker) => {
+    const requirement = task.data.policy?.requirements.find((item) => item.ruleId === blocker.ruleId && item.before === "write");
+    return !(requirement?.acceptanceAllowed && workspace.ok && workspace.data && applicableDecision(task.data, workspace.data, requirement, store.root).length > 0);
+  });
+  const gate = {
+    blockers,
+    root: store.root,
+    plans,
+    key: cacheKey,
+    planKey: planKeyOf(store.root, plans)
+  };
+  cache2.set(store.root, gate);
+  if (cache2.size > 32)
+    cache2.delete(cache2.keys().next().value);
+  return gate;
+};
+var init_write_gate = __esm(() => {
+  init_task_store();
+  init_derive();
+  init_task_evaluation();
+  init_ledger();
+  NONE3 = { kind: "none" };
+  CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
+  PREFIXES3 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
+  cache2 = new Map;
+});
+// packages/workit-core/src/hooks/stop.ts
+import { spawnSync as spawnSync13 } from "node:child_process";
 function stopObligation(input, descriptor) {
   try {
     const session = input.session.id;
@@ -18596,7 +18904,7 @@ var NONE4, QUESTION, OFFER, YES_NO, LIST_ITEM, asksUser = (message) => {
 `);
   return QUESTION.test(tail) || OFFER.test(tail) || YES_NO.test(tail);
 }, short = (sha) => (sha ?? "?").slice(0, 12), gitList = (cwd, args) => {
-  const run = spawnSync12("git", args, {
+  const run = spawnSync13("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 3000,
@@ -18906,10 +19214,10 @@ var init_skill_nudge = __esm(() => {
 });
 // packages/workit-core/src/hooks/hosts/fields.ts
-import { existsSync as existsSync6, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
-import path20 from "node:path";
+import { existsSync as existsSync7, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
+import path22 from "node:path";
 var isRecord4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value), nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "", optionalText = (value) => typeof value === "string" ? value : null, existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path20.isAbsolute(value) || !existsSync6(value))
+  if (!nonEmpty2(value) || !path22.isAbsolute(value) || !existsSync7(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -19005,7 +19313,7 @@ function handleHook(input, deps) {
       if (skillRead)
         recordSkillLoad(input, skillRead, "read");
       const canDeny = usable2(descriptor.shellPolicy.deny);
-      const policy = canDeny ? shellPolicy(input.cwd, event.command) : NONE5;
+      const policy = canDeny ? shellPolicy(input.cwd, event.command, event.dialect) : NONE5;
       if (policy.kind !== "none")
         return policy;
       const postTool = usable2(descriptor.events["shell.post"].support);
@@ -19059,17 +19367,20 @@ var usable2 = (value) => value === "native" || value === "partial", NONE5, resen
   const role = workitRole(descriptor, event.agentType);
   const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
   const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
+  const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
-    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${ISOLATED_GIT} Use a policy-compliant branch (e.g. feature/<slug>); branch policy hooks still deny protected or non-compliant branches. Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${ISOLATED_GIT} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
     return `${ISOLATED_GIT}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
-    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (e.g. feature/<slug>); branch policy hooks still deny protected or non-compliant branches. Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
+  if (session)
+    recordIssuedSession(input.cwd || process.cwd(), session, own);
   return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> --session ${own} ...\` so the ledger tells it apart from the author.`;
 }, failureDecision = (descriptor, event, error) => {
   if (event === "shell.pre" || event === "tool.pre" || event === "write.pre")
@@ -19101,6 +19412,8 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
 };
 var init_handle = __esm(() => {
   init_context();
+  init_branch();
+  init_host_session();
   init_policy();
   init_raw_git();
   init_skill_nudge();
@@ -19638,13 +19951,13 @@ var init_codex = __esm(() => {
       };
     },
     render: render2,
-    addendum: (input) => `<workit-codex-mutations>Codex MCP is read-only: unattested callers cannot mutate. Run workit verbs with the workit CLI on the shell (node_modules/.bin/workit, or npx -y @brainervirus/workit-cli): check, git branch|commit|push, pr, ci, stack, ledger, handoff; task-family mutations take --json${input.session.id ? ` --actor ${input.session.id}` : ""}. workit acts as this thread (CODEX_THREAD_ID${input.session.id ? `=${input.session.id}` : ""}) unless WORKIT_SESSION_ID is set. A verifier or reviewer records workit ledger verdict under its own session, never the author's: a workit-verifier or workit-reviewer agent uses the --session its SubagentStart context names; any other uses one the lead assigns (WORKIT_HOST=codex_cli WORKIT_SESSION_ID=<lead>-v<n>). Merge and release need a workspace grant (workit grant show); a question answer is not host permission.</workit-codex-mutations>`
+    addendum: (input) => `<workit-codex-mutations>Codex MCP is read-only: unattested callers cannot mutate. Run workit verbs with the workit CLI on the shell (node_modules/.bin/workit, or npx -y @brainervirus/workit-cli): check, git branch|commit|push, pr, ci, stack, ledger, handoff; task-family mutations take --json${input.session.id ? ` --actor ${input.session.id}` : ""}. workit acts as this thread (CODEX_THREAD_ID${input.session.id ? `=${input.session.id}` : ""}) unless WORKIT_SESSION_ID is set. A verifier or reviewer records workit ledger verdict under its own session, never the author's: a workit-verifier or workit-reviewer agent uses the --session its SubagentStart context names; any other passes --as verifier (an id derived from its own thread). A hand-minted id such as <lead>-v1 is refused as forged_session. Merge and release need a workspace grant (workit grant show); a question answer is not host permission.</workit-codex-mutations>`
   };
 });
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import fs16 from "node:fs";
-import path21 from "node:path";
+import fs17 from "node:fs";
+import path23 from "node:path";
 var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (value) => {
   if (!isRecord4(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
@@ -19725,17 +20038,17 @@ var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (valu
       };
   }
 }, TRANSCRIPT_TAIL_BYTES, lastAssistantText = (file) => {
-  if (!file || !path21.isAbsolute(file))
+  if (!file || !path23.isAbsolute(file))
     return null;
   try {
-    const size = fs16.statSync(file).size;
+    const size = fs17.statSync(file).size;
     const start = Math.max(0, size - TRANSCRIPT_TAIL_BYTES);
     const buffer = Buffer.alloc(size - start);
-    const fd = fs16.openSync(file, "r");
+    const fd = fs17.openSync(file, "r");
     try {
-      fs16.readSync(fd, buffer, 0, buffer.length, start);
+      fs17.readSync(fd, buffer, 0, buffer.length, start);
     } finally {
-      fs16.closeSync(fd);
+      fs17.closeSync(fd);
     }
     const lines = buffer.toString("utf8").split(`
 `);
@@ -19761,7 +20074,7 @@ var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (valu
   } catch {
     return null;
   }
-}, within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path21.sep) ? root : `${root}${path21.sep}`), hookCwd = (input) => {
+}, within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path23.sep) ? root : `${root}${path23.sep}`), hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
     return cwd;