@brainervirus/workit-mcp 1.2.1 → 1.3.1

package/dist/index.js

@@ -6620,11 +6620,11 @@ var require_dist = __commonJS(function(exports, module) {
 
 // packages/workit-mcp/src/index.ts
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import path15 from "node:path";
+import path16 from "node:path";
 
 // packages/workit-mcp/src/server.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8, realpathSync as realpathSync7 } from "node:fs";
-import path14 from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync8, realpathSync as realpathSync8 } from "node:fs";
+import path15 from "node:path";
 
 // node_modules/@modelcontextprotocol/sdk/node_modules/zod/v4/core/core.js
 var NEVER = Object.freeze({
@@ -12477,8 +12477,8 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // packages/workit-core/src/core.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync5, realpathSync as realpathSync6 } from "node:fs";
-import path10 from "node:path";
+import { existsSync as existsSync5, realpathSync as realpathSync7 } from "node:fs";
+import path11 from "node:path";
 
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -17785,6 +17785,17 @@ function _array2(Class, element, params) {
     ...normalizeParams2(params)
   });
 }
+function _custom2(Class, fn, _params) {
+  const norm = normalizeParams2(_params);
+  norm.abort ?? (norm.abort = true);
+  const schema = new Class({
+    type: "custom",
+    check: "custom",
+    fn,
+    ...norm
+  });
+  return schema;
+}
 function _refine2(Class, fn, _params) {
   const schema = new Class({
     type: "custom",
@@ -19938,6 +19949,9 @@ var ZodCustom2 = /* @__PURE__ */ $constructor2("ZodCustom", (inst, def) => {
   ZodType2.init(inst, def);
   inst._zod.processJSONSchema = (ctx, json, params) => customProcessor(inst, ctx, json, params);
 });
+function custom2(fn, _params) {
+  return _custom2(ZodCustom2, fn ?? (() => true), _params);
+}
 function refine2(fn, _params = {}) {
   return _refine2(ZodCustom2, fn, _params);
 }
@@ -20371,7 +20385,8 @@ var decisionSchema = object4({
   consumption: object4({
     state: _enum2(["reserved", "consumed", "uncertain"]),
     at: utc,
-    actionRef: refSchema
+    actionRef: refSchema,
+    historicalActionId: text.optional()
   }).strict().nullable()
 }).strict();
 var findingSchema = object4({
@@ -20514,7 +20529,7 @@ var taskSummarySchema = object4({
   requirements: array3(requirementEvaluationSchema),
   writer: workspaceRecordSchema.shape.writer
 }).strict();
-var taskListItemSchema = taskSummarySchema.omit({ policy: true, requirements: true });
+var taskListItemSchema = taskSummarySchema.omit({ policy: true, requirements: true }).extend({ source: provenanceSchema.pick({ host: true, kind: true }) }).strict();
 var exportBundleSchema = object4({
   schemaVersion: literal3(1),
   exportedAt: utc,
@@ -20539,6 +20554,7 @@ var taskOperations = {
   list: operation({
     action: literal3("list"),
     status: _enum2(["open", "closed", "all"]).optional(),
+    query: string5().trim().min(1).max(200).optional(),
     limit: number5().int().min(1).max(50).optional()
   }),
   inspect: operation({
@@ -20739,7 +20755,47 @@ function operationJsonSchema(family) {
   return toJSONSchema(operationSchemas[family], { target: "draft-2020-12" });
 }
 var OPERATION_SCHEMA_DEPTH = 1;
-var canonicalFieldsDescription = (fields) => `Canonical object fields: ${fields.join(", ")}. Workit validates the complete nested value.`;
+var schemaShapeDescription = (value, depth = 0) => {
+  if (!value || typeof value !== "object")
+    return "value";
+  const schema = value;
+  if (Array.isArray(schema.oneOf) || Array.isArray(schema.anyOf)) {
+    const options = Array.isArray(schema.oneOf) ? schema.oneOf : schema.anyOf;
+    return `(${options.map((option) => schemaShapeDescription(option, depth)).join("|")})`;
+  }
+  if (schema.const !== undefined)
+    return `=${JSON.stringify(schema.const)}`;
+  if (Array.isArray(schema.enum))
+    return `[${schema.enum.map(String).join("|")}]`;
+  const type = Array.isArray(schema.type) ? schema.type.join("/") : schema.type;
+  if (type === "array")
+    return `arr<${schemaShapeDescription(schema.items, depth)}>`;
+  if (type === "object" && schema.properties && typeof schema.properties === "object") {
+    if (depth >= 2)
+      return "obj";
+    const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+    const properties = schema.properties;
+    const fields = Object.entries(properties).map(([name, child]) => `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child, depth + 1)}`);
+    return `obj{${fields.join(",")}}`;
+  }
+  if (typeof type !== "string")
+    return "?";
+  return type.split("/").map((part) => ({ string: "str", boolean: "bool", number: "num", null: "null" })[part] ?? part).join("|");
+};
+var canonicalFieldsDescription = (value) => {
+  if (Array.isArray(value))
+    return `Canonical object fields: ${value.join(", ")}. Workit validates the complete nested value.`;
+  const isZodType = (schema) => ("_zod" in schema) && typeof schema._zod === "object";
+  const schema = isZodType(value) ? toJSONSchema(value, { target: "draft-2020-12" }) : value;
+  if (!schema.properties || typeof schema.properties !== "object") {
+    const variants = Array.isArray(schema.oneOf) ? schema.oneOf : Array.isArray(schema.anyOf) ? schema.anyOf : null;
+    return variants ? `Canonical shapes: ${variants.map((variant) => schemaShapeDescription(variant)).join(" | ")}. Full nested value is validated.` : "Canonical nested value; Workit validates the complete value.";
+  }
+  const properties = schema.properties;
+  const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+  const fields = Object.entries(properties).map(([name, child]) => `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child)}`);
+  return `Fields (! required): ${fields.join(", ")}. Full nested value is validated.`;
+};
 function boundedOperationJsonSchema(family, maxDepth = OPERATION_SCHEMA_DEPTH, stringifiedObjects = false) {
   const tolerate = (projected) => {
     if (!stringifiedObjects)
@@ -20763,9 +20819,10 @@ function boundedOperationJsonSchema(family, maxDepth = OPERATION_SCHEMA_DEPTH, s
       return node;
     const record = node;
     if (record.properties && typeof record.properties === "object") {
-      const fields = Object.keys(record.properties);
+      const properties = record.properties;
+      const fields = Object.keys(properties);
       if (currentDepth >= maxDepth || fields.length === 0) {
-        const description = stringifiedObjects ? `${canonicalFieldsDescription(fields)} A JSON-encoded string is also accepted.` : canonicalFieldsDescription(fields);
+        const description = stringifiedObjects ? `${canonicalFieldsDescription(record)} A JSON-encoded string is also accepted.` : canonicalFieldsDescription(record);
         return tolerate({ type: "object", description });
       }
       return tolerate({
@@ -20886,6 +20943,7 @@ function requirementId(input) {
 }
 // packages/workit-core/src/core/task-store.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as fs4 from "node:fs";
 import { hostname as hostname2 } from "node:os";
 import path4 from "node:path";
@@ -21521,7 +21579,8 @@ var metadataLockSchema = object4({
   pid: number5().int().nonnegative().safe(),
   processStart: string5().nullable(),
   host: string5().min(1),
-  nonce: string5().min(1)
+  nonce: string5().min(1),
+  externalAction: literal3(true).optional()
 }).strict();
 var now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
 var cachedRuntimeVersion = null;
@@ -21573,6 +21632,28 @@ var sameMetadataLock = (left, right) => {
   const parsed = metadataLockSchema.safeParse(left);
   return parsed.success && canonicalJson(parsed.data) === canonicalJson(right);
 };
+var sameDirectoryIdentity = (left, right) => {
+  if (!path4.isAbsolute(left) || !path4.isAbsolute(right))
+    return false;
+  const normalizedLeft = path4.resolve(left);
+  const normalizedRight = path4.resolve(right);
+  try {
+    const a = fs4.statSync(normalizedLeft, { bigint: true });
+    const b = fs4.statSync(normalizedRight, { bigint: true });
+    if (!a.isDirectory() || !b.isDirectory())
+      return false;
+    if (process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight)
+      return true;
+    const canonicalLeft = fs4.realpathSync(normalizedLeft);
+    const canonicalRight = fs4.realpathSync(normalizedRight);
+    if (process.platform === "win32" ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase() : canonicalLeft === canonicalRight)
+      return true;
+    return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
+  } catch {
+    return false;
+  }
+};
+var externalActionLockRoots = new AsyncLocalStorage;
 
 class TaskStore {
   root;
@@ -21633,7 +21714,7 @@ class TaskStore {
     const item = this.readRecord(this.workspacePath, workspaceRecordSchema);
     if (!item.exists)
       return success(null, null, null);
-    if (item.result.ok && item.result.data.root !== this.root)
+    if (item.result.ok && item.result.data.root !== this.root && !sameDirectoryIdentity(item.result.data.root, this.root))
       return failure("recovery_required", "workspace root binding is invalid", {
         path: this.workspacePath
       });
@@ -21724,6 +21805,29 @@ class TaskStore {
       const current = this.readWorkspace();
       if (!current.ok)
         return current;
+      const origin = input.task.origin;
+      if (current.data && origin) {
+        if (origin.workspaceId === current.data.id) {
+          const source = this.readTask(origin.taskId);
+          if (source.ok)
+            return success(source.data.revision, current.data.revision, source.data);
+          if (source.code !== "not_found")
+            return source;
+          return failure("not_found", "source task is not present in this shared workspace");
+        }
+        const tasks = this.listTasks();
+        if (!tasks.ok)
+          return tasks;
+        const prior = tasks.data.filter((task) => task.origin?.workspaceId === origin.workspaceId && task.origin?.taskId === origin.taskId);
+        if (prior.length > 1)
+          return failure("recovery_required", `source task has multiple imported mappings: ${prior.map((task) => task.id).join(", ")}`);
+        if (prior.length === 1) {
+          const existing = prior[0];
+          if (existing.origin.exportDigest !== origin.exportDigest)
+            return failure("revision_conflict", "source task export changed; reconcile the mapped destination task before importing", { taskId: existing.id });
+          return success(existing.revision, current.data.revision, existing);
+        }
+      }
       if (current.data ? input.expectedWorkspaceRevision !== current.data.revision : input.expectedWorkspaceRevision !== null)
         return failure("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", {
           expectedWorkspaceRevision: input.expectedWorkspaceRevision,
@@ -22112,6 +22216,73 @@ class TaskStore {
       })
     };
   }
+  externalActionLockOptions() {
+    const options = this.metadataLockOptions();
+    return { ...options, payload: () => ({ ...options.payload(), externalAction: true }) };
+  }
+  async withExternalActionLock(operation, reentrant = false) {
+    const activeRoots = externalActionLockRoots.getStore();
+    if (activeRoots && [...activeRoots].some((root) => root === this.root || sameDirectoryIdentity(root, this.root)))
+      return operation();
+    try {
+      this.initializeMutationStorage();
+    } catch (error) {
+      return failure("storage_error", `unable to initialize store: ${String(error)}`, {
+        path: this.workitDir
+      });
+    }
+    let handle;
+    try {
+      handle = acquireFileLockSync(this.workspacePath, this.externalActionLockOptions());
+    } catch (error) {
+      return this.lockFailure(error);
+    }
+    let result;
+    try {
+      if (!handle.verifyStillHeld())
+        result = failure("recovery_required", "metadata lock was compromised", {
+          path: this.lockPath
+        });
+      else {
+        try {
+          const run = () => operation();
+          result = await (reentrant ? externalActionLockRoots.run(new Set([...activeRoots ?? [], this.root]), run) : run());
+        } catch {
+          result = failure("external_outcome_unknown", "external action outcome is unknown", {
+            outcome: "unknown"
+          });
+        }
+        try {
+          if (!handle.verifyStillHeld())
+            result = failure("external_outcome_unknown", "metadata lock was compromised", {
+              outcome: "unknown",
+              path: this.lockPath
+            });
+        } catch {
+          result = failure("external_outcome_unknown", "metadata lock could not be verified", {
+            outcome: "unknown",
+            path: this.lockPath
+          });
+        }
+      }
+    } catch {
+      result = failure("external_outcome_unknown", "external action lock operation failed", {
+        outcome: "unknown",
+        path: this.lockPath
+      });
+    }
+    try {
+      handle.release();
+    } catch (error) {
+      const released = this.lockFailure(error);
+      const releaseError = released.ok ? "metadata lock release failed" : released.error;
+      return result.ok ? failure("external_outcome_unknown", "external action metadata lock release is uncertain", {
+        outcome: "unknown",
+        path: this.lockPath
+      }) : failure("recovery_required", `${result.error}; ${releaseError}`, result.details);
+    }
+    return result;
+  }
   recoveryLockOptions(observed, evidence, gate) {
     const options = this.metadataLockOptions();
     options.staleRecovery = "remove-if-unchanged";
@@ -22181,6 +22352,14 @@ class TaskStore {
   lockFailure(error) {
     const value = error;
     const code = typeof value?.code === "string" ? value.code : "";
+    if (code === "EEXIST" || code === "file_lock_timeout") {
+      const lock = this.readLockSnapshot();
+      if (lock.ok && lock.data?.data.externalAction)
+        return failure("writer_conflict", "workspace is reserved by a managed external action", {
+          outcome: "not_started",
+          path: this.lockPath
+        });
+    }
     const recovery = code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || code === "metadata_lock_invalid" || code === "not-file" || /metadata lock|file lock|reclaim/i.test(String(value?.message ?? error));
     return failure(recovery ? "recovery_required" : "storage_error", `metadata lock operation failed: ${String(error)}`, { path: this.lockPath });
   }
@@ -22448,21 +22627,23 @@ function assertProductWriteAllowed(input) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import * as fs7 from "node:fs";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import path9 from "node:path";
+import path10 from "node:path";
 
 // packages/workit-core/src/core/authority.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import * as fs6 from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // packages/workit-core/src/core/auto-approval.ts
-import { createHash as createHash3 } from "node:crypto";
-import { readFileSync as readFileSync4 } from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
+import { readFileSync as readFileSync4, realpathSync as realpathSync3 } from "node:fs";
+import path8 from "node:path";
 
 // packages/workit-core/src/core/workspaces.ts
+import { createHash as createHash3 } from "node:crypto";
 import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
 import path6 from "node:path";
 
@@ -22480,7 +22661,7 @@ import os from "node:os";
 import path5 from "node:path";
 
 // packages/workit-core/src/core/boundary.ts
-import { statSync } from "node:fs";
+import { statSync as statSync2 } from "node:fs";
 var EVENT = {
   initialization: "initialization",
   provenance: "provenance",
@@ -22508,7 +22689,7 @@ var changedSourcesSinceLoad = (marker) => {
   const changed = [];
   for (const file of marker.files) {
     try {
-      if (statSync(file).mtimeMs > marker.loadedAt)
+      if (statSync2(file).mtimeMs > marker.loadedAt)
         changed.push(file);
     } catch {}
   }
@@ -22667,33 +22848,197 @@ var COMMIT_PRESETS = [
   "custom",
   "auto"
 ];
+var resolveCommitPolicy = (config, workspace) => {
+  const wp = workspace?.commitPolicy ?? {};
+  if (COMMIT_PRESETS.includes(String(wp.preset ?? ""))) {
+    return {
+      preset: wp.preset,
+      ...typeof wp.pattern === "string" ? { pattern: wp.pattern } : {}
+    };
+  }
+  return config.commitPolicy ?? { preset: "conventional" };
+};
 
 // packages/workit-core/src/core/workspaces.ts
+var nonBlank = string5().refine((value) => value.trim().length > 0, "must not be blank");
+var branchPreset = custom2((value) => typeof value === "string" && Object.hasOwn(PRESETS, value), "unsupported branch preset");
+var commitPreset = custom2((value) => typeof value === "string" && COMMIT_PRESETS.includes(value), "unsupported commit preset");
+var workspaceBranchPolicySchema = object4({
+  preset: branchPreset,
+  developBranch: nonBlank.optional(),
+  prefixes: object4({
+    feature: nonBlank,
+    bugfix: nonBlank,
+    release: nonBlank,
+    hotfix: nonBlank
+  }).passthrough().optional(),
+  allowed: array3(nonBlank).optional(),
+  protected: array3(nonBlank).optional(),
+  integration: _enum2(["pr", "merge"]).optional()
+}).strict();
+var workspaceCommitPolicySchema = object4({ preset: commitPreset, pattern: string5().optional() }).strict();
+var workspaceProfileSchema = object4({
+  branchPolicy: workspaceBranchPolicySchema.optional(),
+  commitPolicy: workspaceCommitPolicySchema.optional()
+}).strict().refine((profile) => profile.branchPolicy !== undefined || profile.commitPolicy !== undefined, {
+  message: "a profile must define branchPolicy or commitPolicy"
+});
+var versionSourceSchema = discriminatedUnion2("kind", [
+  object4({
+    kind: literal3("package-json"),
+    path: nonBlank,
+    field: nonBlank
+  }).strict(),
+  object4({ kind: literal3("git-tag") }).strict(),
+  object4({ kind: literal3("manual") }).strict()
+]);
+var releaseTrackSchema = object4({
+  strategy: branchPreset,
+  productionBranch: nonBlank,
+  integrationBranch: nonBlank,
+  naming: object4({ feature: nonBlank, release: nonBlank, hotfix: nonBlank }).strict(),
+  baseBranch: nonBlank,
+  mergeBackBranches: array3(nonBlank),
+  pullRequestTarget: nonBlank,
+  tagNamespace: string5(),
+  versionSource: versionSourceSchema,
+  requiredChecks: array3(nonBlank)
+}).strict().superRefine((track, context) => {
+  for (const [field, values] of [
+    ["mergeBackBranches", track.mergeBackBranches],
+    ["requiredChecks", track.requiredChecks]
+  ]) {
+    if (new Set(values).size !== values.length) {
+      context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
+    }
+  }
+  if (track.versionSource.kind === "package-json" && (path6.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+    context.addIssue({
+      code: "custom",
+      path: ["versionSource", "path"],
+      message: "must stay inside the repository"
+    });
+  }
+});
+var workspaceConfigSchema = object4({
+  name: nonBlank,
+  glob: nonBlank,
+  vcs: object4({
+    provider: _enum2(["gitlab", "github"]),
+    defaultTargetBranch: nonBlank.optional(),
+    tokenFile: nonBlank.optional(),
+    account: nonBlank.optional()
+  }).passthrough().optional(),
+  autoApprove: union3([boolean5(), array3(nonBlank)]).optional(),
+  youtrack: object4({ baseUrl: nonBlank.optional(), link_issues: boolean5().optional() }).passthrough().optional(),
+  issues: object4({ provider: literal3("github").optional(), link_on_pr: boolean5().optional() }).passthrough().optional(),
+  branchPolicy: workspaceBranchPolicySchema.optional(),
+  commitPolicy: workspaceCommitPolicySchema.optional(),
+  defaultProfile: nonBlank.optional(),
+  profiles: record3(nonBlank, workspaceProfileSchema).optional(),
+  releaseTracks: record3(nonBlank, releaseTrackSchema).optional()
+}).passthrough().superRefine((workspace, context) => {
+  if (workspace.youtrack && workspace.vcs?.provider !== "gitlab") {
+    context.addIssue({
+      code: "custom",
+      path: ["youtrack"],
+      message: `YouTrack issue linking requires the gitlab provider, got ${workspace.vcs?.provider ?? "unset"}`
+    });
+  }
+  if (workspace.issues && workspace.vcs?.provider !== "github") {
+    context.addIssue({
+      code: "custom",
+      path: ["issues"],
+      message: `GitHub issue linking requires the github provider, got ${workspace.vcs?.provider ?? "unset"}`
+    });
+  }
+  if (workspace.defaultProfile !== undefined && !Object.hasOwn(workspace.profiles ?? {}, workspace.defaultProfile)) {
+    context.addIssue({
+      code: "custom",
+      path: ["defaultProfile"],
+      message: `does not name a configured profile`
+    });
+  }
+});
+var workspacesFileSchema = object4({ workspaces: array3(workspaceConfigSchema).optional() }).passthrough().superRefine((file, context) => {
+  const names = new Set;
+  for (const [index, workspace] of (file.workspaces ?? []).entries()) {
+    if (names.has(workspace.name)) {
+      context.addIssue({
+        code: "custom",
+        path: ["workspaces", index, "name"],
+        message: `duplicate workspace name ${JSON.stringify(workspace.name)}`
+      });
+    }
+    names.add(workspace.name);
+  }
+});
+var workspacesRevision = (contents) => createHash3("sha256").update(contents ?? "<missing>").digest("hex");
+var validateWorkspacesDocument = (parsed, file) => {
+  if (!isConfigObject(parsed)) {
+    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+  }
+  const validated = workspacesFileSchema.safeParse(parsed, { reportInput: true });
+  if (!validated.success) {
+    const detail = validated.error.issues.map((issue) => {
+      const field = String(issue.path[issue.path.length - 1] ?? "");
+      const attempted = ["provider", "preset", "strategy"].includes(field) && typeof issue.input === "string" ? ` (${JSON.stringify(issue.input)})` : "";
+      return `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}${attempted}`;
+    }).join("; ");
+    return {
+      status: "invalid",
+      path: file,
+      entries: [],
+      error: `${file} has invalid workspace configuration: ${detail}`
+    };
+  }
+  for (const [index, workspace] of (validated.data.workspaces ?? []).entries()) {
+    const glob = validateWorkspaceGlob(workspace.glob);
+    if (!glob.ok) {
+      return {
+        status: "invalid",
+        path: file,
+        entries: [],
+        error: `${file} workspaces.${index}.glob: ${glob.error}`
+      };
+    }
+  }
+  return {
+    status: "valid",
+    path: file,
+    entries: validated.data.workspaces ?? [],
+    document: parsed
+  };
+};
 var readWorkspacesResult = (dir = configDir()) => {
   const file = path6.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
-  } catch {
-    return { status: "missing", path: file, entries: [] };
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { status: "missing", path: file, entries: [], revision: workspacesRevision(null) };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      error: `${file} could not be read: ${error instanceof Error ? error.message : String(error)}`
+    };
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not valid JSON` };
-  }
-  if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      revision: workspacesRevision(raw),
+      error: `${file} is not valid JSON`
+    };
   }
-  const list = parsed.workspaces;
-  return {
-    status: "valid",
-    path: file,
-    entries: Array.isArray(list) ? list : []
-  };
+  return { ...validateWorkspacesDocument(parsed, file), revision: workspacesRevision(raw) };
 };
-var loadWorkspacesFrom = (dir) => readWorkspacesResult(dir).entries;
 var globToRegExp = (glob) => {
   let out = "";
   for (let i = 0;i < glob.length; i++) {
@@ -22728,6 +23073,30 @@ var globToRegExp = (glob) => {
   return new RegExp(`^${out}$`);
 };
 var matchWorkspace = (glob, target) => globToRegExp(glob.replaceAll("\\", "/")).test(target.replaceAll("\\", "/"));
+var UNSUPPORTED_GLOB = /[?[\]{}]/;
+var UNSUPPORTED_EXTGLOB = /[@+*]\(|!/;
+var validateWorkspaceGlob = (glob) => {
+  const trimmed = glob.trim();
+  if (!trimmed)
+    return { ok: false, error: "workspace pattern is required" };
+  const m = UNSUPPORTED_GLOB.exec(trimmed);
+  if (m) {
+    return {
+      ok: false,
+      error: `unsupported glob character ${JSON.stringify(m[0])} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
+    };
+  }
+  const ext = UNSUPPORTED_EXTGLOB.exec(trimmed);
+  if (ext) {
+    const token = ext[0];
+    const kind = token === "!" ? "negation (!)" : `extglob (${token})`;
+    return {
+      ok: false,
+      error: `unsupported glob ${kind} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
+    };
+  }
+  return { ok: true };
+};
 var realpathOf = (p) => {
   const real = realpathSync2.native ?? realpathSync2;
   try {
@@ -22745,29 +23114,132 @@ var canonicalGlob = (glob) => {
   const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
   return real + (prefix.endsWith("/") ? "/" : "") + rest;
 };
-var resolveWorkspaceFrom = (cwd, dir) => {
+var globSpecificity = (glob) => glob.replaceAll("\\", "/").split("/").filter((segment) => segment.length > 0 && !/[*?[\]{]/.test(segment)).length;
+var selectWorkspaceMatch = (matches, cwd, workspaceName) => {
+  if (workspaceName !== undefined) {
+    const named = matches.filter((entry) => entry.name === workspaceName);
+    if (named.length === 1)
+      return named[0];
+    if (named.length > 1)
+      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
+    if (matches.length > 0) {
+      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
+    }
+    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
+  }
+  if (matches.length < 2)
+    return matches[0];
+  const highestSpecificity = Math.max(...matches.map((entry) => globSpecificity(entry.glob)));
+  const mostSpecific = matches.filter((entry) => globSpecificity(entry.glob) === highestSpecificity);
+  if (mostSpecific.length > 1) {
+    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
+  }
+  return mostSpecific[0];
+};
+var resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
+  const result = readWorkspacesResult(dir);
+  if (result.status === "malformed" || result.status === "invalid")
+    throw new Error(result.error);
   const targets = [cwd, realpathOf(cwd)].map((p) => p.replaceAll("\\", "/"));
-  for (const entry of loadWorkspacesFrom(dir)) {
-    if (!entry || typeof entry !== "object")
-      continue;
-    const ws = entry;
-    if (typeof ws.glob !== "string" || !ws.glob)
-      continue;
+  const matches = [];
+  for (const ws of result.entries) {
     const glob = ws.glob.replaceAll("\\", "/");
     const canonical = canonicalGlob(glob);
+    let matched = false;
     for (const target of targets) {
-      if (matchWorkspace(glob, target))
-        return ws;
-      if (canonical !== glob && matchWorkspace(canonical, target))
-        return ws;
+      if (matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target)) {
+        matched = true;
+        break;
+      }
     }
+    if (matched)
+      matches.push(ws);
   }
-  return null;
+  return selectWorkspaceMatch(matches, cwd, workspaceName) ?? null;
+};
+var runtimeWorkspacePolicySchema = (kind) => {
+  const key = kind === "branch" ? "branchPolicy" : kind === "commit" ? "commitPolicy" : "vcs";
+  const policySchema = kind === "branch" ? workspaceBranchPolicySchema : kind === "commit" ? workspaceCommitPolicySchema : object4({
+    provider: _enum2(["gitlab", "github"]),
+    defaultTargetBranch: nonBlank.optional(),
+    account: nonBlank.optional()
+  }).passthrough();
+  const profileSchema = object4({ [key]: policySchema.optional() }).passthrough();
+  const entrySchema = object4({
+    name: nonBlank,
+    glob: nonBlank,
+    [key]: policySchema.optional(),
+    defaultProfile: nonBlank.optional(),
+    profiles: record3(nonBlank, profileSchema).optional()
+  }).passthrough();
+  return entrySchema;
+};
+var resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs");
+var runtimeWorkspaceIndexSchema = object4({
+  workspaces: array3(object4({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
+}).passthrough();
+var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+  const file = path6.join(configDir(), "workspaces.json");
+  let raw;
+  try {
+    raw = readFileSync3(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw new Error(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`${file} is not valid JSON`);
+  }
+  const validated = runtimeWorkspaceIndexSchema.safeParse(parsed);
+  if (!validated.success) {
+    const detail = validated.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}`).join("; ");
+    throw new Error(`${file} has invalid workspace matching data: ${detail}`);
+  }
+  const entries = validated.data.workspaces;
+  for (const entry of entries ?? []) {
+    const glob = validateWorkspaceGlob(entry.glob);
+    if (!glob.ok)
+      throw new Error(`${file} workspace ${entry.name}: ${glob.error}`);
+  }
+  const targets = [cwd, realpathOf(cwd)].map((value) => value.replaceAll("\\", "/"));
+  const matches = (entries ?? []).filter((entry) => {
+    const glob = entry.glob.replaceAll("\\", "/");
+    const canonical = canonicalGlob(glob);
+    return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
+  });
+  const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
+  const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
+  if (!selected)
+    return null;
+  const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
+  if (!policy.success) {
+    const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
+    throw new Error(`${file} has invalid ${kind} policy configuration: ${detail}`);
+  }
+  return policy.data;
+};
+var resolveRuntimeWorkspacePolicy = (cwd, kind, requestedProfile) => {
+  const candidate = resolveRuntimeWorkspaceCandidate(cwd, kind);
+  if (!candidate)
+    return { policy: undefined, source: "user-default" };
+  const key = kind === "branch" ? "branchPolicy" : "commitPolicy";
+  const profileName = requestedProfile?.trim() || candidate.defaultProfile;
+  if (candidate.defaultProfile && !Object.hasOwn(candidate.profiles ?? {}, candidate.defaultProfile))
+    throw new Error(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(candidate.defaultProfile)}`);
+  const profile = profileName ? candidate.profiles?.[profileName] : undefined;
+  if (profileName && !profile)
+    throw new Error(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(profileName)}`);
+  const profilePolicy = profile?.[key];
+  const workspacePolicy = candidate[key];
+  return {
+    policy: profilePolicy ?? workspacePolicy,
+    source: profilePolicy ? `profile:${profileName}` : workspacePolicy ? `workspace:${candidate.name}` : "user-default"
+  };
 };
-var resolveWorkspace = (cwd) => resolveWorkspaceFrom(cwd, configDir());
-
-// packages/workit-core/src/core/branch.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
 
 // packages/workit-core/src/core/git.ts
 import { execFileSync } from "node:child_process";
@@ -22841,7 +23313,6 @@ var gitContext = (workspaceRoot, paths = []) => {
 import fs5 from "node:fs";
 import path7 from "node:path";
 import { spawnSync } from "node:child_process";
-var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
 var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path7.join(configDir(), "vcs.json");
 var vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
 var remoteProvider = (cwd) => {
@@ -22855,6 +23326,79 @@ var remoteProvider = (cwd) => {
     return "gitlab";
   return null;
 };
+var remoteEndpoint = (remote) => {
+  const raw = remote.trim();
+  if (!raw)
+    return null;
+  const scp = /^(?:[^@\s]+@)?([^:]+):(.+)$/u.exec(raw);
+  if (scp && !raw.includes("://"))
+    return {
+      host: scp[1].toLowerCase(),
+      path: scp[2].replace(/^\//u, "").replace(/\.git$/u, ""),
+      protocol: "ssh:",
+      port: ""
+    };
+  try {
+    const url = new URL(raw);
+    return {
+      host: url.hostname.toLowerCase(),
+      path: url.pathname.replace(/^\//u, "").replace(/\.git$/u, "").replace(/\/$/u, ""),
+      protocol: url.protocol,
+      port: url.port
+    };
+  } catch {
+    return null;
+  }
+};
+var configuredSshEndpoint = (host) => {
+  if (host.startsWith("-"))
+    return null;
+  const resolved = spawnSync("ssh", ["-G", host], {
+    encoding: "utf8",
+    timeout: 5000,
+    maxBuffer: 1024 * 1024,
+    env: { ...process.env, PATH: process.env.PATH ?? "" }
+  });
+  if (resolved.status !== 0)
+    return null;
+  const output = resolved.stdout ?? "";
+  const hostname = /^hostname\s+(\S+)/imu.exec(output)?.[1]?.toLowerCase();
+  if (!hostname)
+    return null;
+  return { host: hostname, port: /^port\s+(\d+)/imu.exec(output)?.[1] ?? "22" };
+};
+var sshApiHostAliases = {
+  "github.com": [{ host: "ssh.github.com", port: "443" }],
+  "gitlab.com": [{ host: "altssh.gitlab.com", port: "443" }]
+};
+var hostingApiHostMatches = (remote, apiHost, resolveSshEndpoint = configuredSshEndpoint) => {
+  const endpoint = remoteEndpoint(remote);
+  if (!endpoint)
+    return false;
+  let expected;
+  try {
+    const url = new URL(`https://${apiHost}`);
+    if (url.pathname !== "/" || url.search || url.hash || url.username || url.password)
+      return false;
+    expected = {
+      host: url.hostname.toLowerCase().replace(/\.$/u, ""),
+      port: url.port
+    };
+  } catch {
+    return false;
+  }
+  if (endpoint.protocol !== "ssh:") {
+    return endpoint.host.replace(/\.$/u, "") === expected.host && endpoint.port === expected.port;
+  }
+  const resolved = resolveSshEndpoint(endpoint.host);
+  if (!resolved)
+    return false;
+  const hostname = resolved.host.toLowerCase().replace(/\.$/u, "");
+  const port = endpoint.port || resolved.port;
+  if (hostname === expected.host)
+    return port === (expected.port || "22");
+  return Boolean(sshApiHostAliases[expected.host]?.some((alias) => alias.host === hostname && alias.port === port && (!expected.port || expected.port === port)));
+};
 var readVcsConfig = () => {
   const file = vcsConfigPath();
   let raw;
@@ -22875,7 +23419,7 @@ var readVcsConfig = () => {
   return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
 };
 function vcsConfig(mode, cwd) {
-  const ws = resolveWorkspace(vcsCwd(cwd));
+  const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
   const wsVcs = ws?.vcs ?? {};
   const wsYt = ws?.youtrack ?? {};
   const wsIssues = ws?.issues ?? {};
@@ -22888,8 +23432,8 @@ function vcsConfig(mode, cwd) {
   const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
   const policyDefault = resolveBranchPolicyFor(root).defaultTargetBranch;
   const defaultTarget = String(wsVcs.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : cfg.defaultTargetBranch ?? policyDefault) ?? "develop");
-  const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
-  const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
+  const linkIssues = provider === "gitlab" && typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
+  const youtrackBaseUrl = provider === "gitlab" && typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   let issuesProvider = null;
   let linkOnPr = null;
   if (provider === "github" && typeof wsIssues.provider === "string" && wsIssues.provider.toLowerCase() === "github") {
@@ -22913,9 +23457,8 @@ function vcsConfig(mode, cwd) {
   if (cfgStatus === "malformed") {
     return { ok: false, error: cfgError, configPath: cfgPath };
   }
-  if (cfgStatus === "missing") {
+  if (cfgStatus === "missing" && provider === null)
     return { ok: false, error: `vcs.json is missing: ${cfgPath}`, configPath: cfgPath };
-  }
   if (provider === null) {
     return {
       ok: false,
@@ -22924,24 +23467,12 @@ function vcsConfig(mode, cwd) {
     };
   }
   const prov = cfg[provider] ?? {};
-  const wsTokenFile = typeof wsVcs.tokenFile === "string" && wsVcs.tokenFile.trim() !== "" ? wsVcs.tokenFile : null;
-  const tokenFile = String(wsTokenFile ?? prov.tokenFile ?? path7.join(configDir(), `${provider}.token`));
-  const tokenPath = path7.resolve(tokenFile);
-  let tokenOk = false;
-  if (fs5.existsSync(tokenPath)) {
-    const token = fs5.readFileSync(tokenPath, "utf8").trim();
-    const placeholder = !token || token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER);
-    tokenOk = !placeholder;
-  }
   const out = {
     ok: true,
     configPath: path7.resolve(cfgPath),
     provider,
     defaultTargetBranch: defaultTarget,
     pr: cfg.pr ?? {},
-    tokenPath,
-    tokenPresent: fs5.existsSync(tokenPath),
-    tokenReady: tokenOk,
     workspace_name: ws?.name ?? null,
     link_issues: linkIssues,
     youtrack_base_url: youtrackBaseUrl,
@@ -22956,16 +23487,58 @@ function vcsConfig(mode, cwd) {
   } else if (provider === "github") {
     out.github = { host: prov.host ?? "github.com" };
   }
-  if (mode === "summary")
-    delete out.tokenPath;
   return out;
 }
+function vcsCliIdentity(cwd) {
+  const root = vcsCwd(cwd);
+  const cfg = vcsConfig("load", root);
+  if (!cfg.ok)
+    return { ok: false, error: cfg.error ?? "vcs config not ready" };
+  const provider = cfg.provider;
+  if (provider !== "gitlab" && provider !== "github")
+    return { ok: false, error: `unsupported provider: ${provider}` };
+  const bin = provider === "gitlab" ? "glab" : "gh";
+  const host = String(provider === "github" ? cfg.github?.host ?? "github.com" : cfg.gitlab?.host ?? "gitlab.com").toLowerCase();
+  const env = {
+    ...process.env,
+    PATH: process.env.PATH ?? "",
+    ...provider === "github" ? { GH_HOST: host } : { GITLAB_HOST: host }
+  };
+  const result = spawnSync(bin, ["api", "user"], {
+    cwd: root,
+    encoding: "utf8",
+    env
+  });
+  if (result.status !== 0)
+    return { ok: false, provider, error: `${bin} is missing or not authenticated` };
+  try {
+    const user = JSON.parse(result.stdout ?? "");
+    const username = provider === "gitlab" ? user.username : user.login;
+    if (typeof username !== "string" || !username)
+      return { ok: false, provider, error: `invalid ${bin} identity response` };
+    const expected = resolveRuntimeWorkspaceVcs(root)?.vcs?.account;
+    if (expected && username.toLowerCase() !== expected.toLowerCase())
+      return {
+        ok: false,
+        provider,
+        error: `${bin} account ${username} does not match ${expected}`
+      };
+    return { ok: true, provider, host, username, name: user.name };
+  } catch {
+    return { ok: false, provider, error: `invalid JSON from ${bin} api user` };
+  }
+}
 function mergedPrStyle(limit = 6, cwd) {
   const cfg = vcsConfig("load", cwd);
-  if (!cfg.ok || !cfg.tokenReady)
+  if (!cfg.ok)
     return { ok: false, error: "vcs not configured" };
   const provider = cfg.provider;
-  const token = fs5.readFileSync(cfg.tokenPath, "utf8").trim();
+  const host = String(provider === "github" ? cfg.github?.host ?? "github.com" : cfg.gitlab?.host ?? "gitlab.com").toLowerCase();
+  const env = {
+    ...process.env,
+    PATH: process.env.PATH ?? "",
+    ...provider === "github" ? { GH_HOST: host } : { GITLAB_HOST: host }
+  };
   const examples = [];
   const descInfo = (desc, caseInsensitiveNotes = false) => ({
     hasNotesSection: caseInsensitiveNotes ? /##\s*notes/i.test(desc) : /##\s*Notes/.test(desc),
@@ -22973,23 +23546,30 @@ function mergedPrStyle(limit = 6, cwd) {
 `).filter((l) => l.startsWith("## ")).map((l) => l.trim()),
     descriptionPreview: desc.slice(0, 600)
   });
+  const remoteResult = spawnSync("git", ["remote", "get-url", "--push", "--all", "origin"], {
+    cwd,
+    encoding: "utf8"
+  });
+  const remotes = (remoteResult.stdout ?? "").split(/\r?\n/u).map((value) => value.trim()).filter(Boolean);
+  if (remotes.length === 0)
+    return { ok: false, error: "no origin remote" };
+  if (remotes.length !== 1)
+    return { ok: false, error: "origin has ambiguous push destinations" };
+  const remote = remotes[0];
+  const endpoint = remoteEndpoint(remote);
+  if (!endpoint?.path)
+    return { ok: false, error: "hosting repository could not be resolved" };
+  if (!hostingApiHostMatches(remote, host))
+    return { ok: false, error: "PR style target does not match the provider host" };
   if (provider === "gitlab") {
-    const remote = spawnSync("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
-    if (remote.status !== 0)
-      return { ok: false, error: "no origin remote" };
-    const url = (remote.stdout ?? "").trim();
-    const m = /gitlab\.com[:/](.+?)(?:\.git)?$/.exec(url);
-    if (!m)
-      return { ok: false, error: "not a gitlab.com origin" };
-    const project = m[1];
-    const env = { ...process.env, GITLAB_TOKEN: token };
-    const run = (args) => spawnSync("glab", ["api", ...args], { cwd, encoding: "utf8", env });
+    const run = (args) => spawnSync("glab", ["api", ...args], {
+      cwd,
+      encoding: "utf8",
+      env
+    });
     let r = run([
-      `projects/${project.replaceAll("/", "%2F")}/merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`
+      `projects/${endpoint.path.replaceAll("/", "%2F")}/merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`
     ]);
-    if (r.status !== 0) {
-      r = run([`merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`]);
-    }
     if (r.status !== 0)
       return { ok: false, error: "could not list merge requests" };
     for (const mr of JSON.parse(r.stdout ?? "[]")) {
@@ -23002,7 +23582,18 @@ function mergedPrStyle(limit = 6, cwd) {
       });
     }
   } else if (provider === "github") {
-    const r = spawnSync("gh", ["pr", "list", "--state", "merged", "--limit", String(limit), "--json", "title,url,body"], { cwd, encoding: "utf8", env: { ...process.env, GH_TOKEN: token } });
+    const r = spawnSync("gh", [
+      "pr",
+      "list",
+      "--repo",
+      `${host}/${endpoint.path}`,
+      "--state",
+      "merged",
+      "--limit",
+      String(limit),
+      "--json",
+      "title,url,body"
+    ], { cwd, encoding: "utf8", env });
     if (r.status !== 0)
       return { ok: false, error: "could not list pull requests" };
     for (const pr of JSON.parse(r.stdout ?? "[]")) {
@@ -23024,26 +23615,28 @@ function mergedPrStyle(limit = 6, cwd) {
 }
 
 // packages/workit-core/src/core/branch.ts
-var resolveBranchPolicyFor = (workspaceRoot) => resolveBranchPolicy(readConfig(), resolveWorkspace(workspaceRoot));
+function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
+  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
+  const config = readConfig();
+  return kind === "branch" ? {
+    branchPolicy: resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null),
+    provenance: { branchPolicy: selected.source }
+  } : {
+    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
+    provenance: { commitPolicy: selected.source }
+  };
+}
+var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
 var verifyPushIdentity = (root, provider, account) => {
   if (!account || typeof account !== "string")
     return { ok: false, error: "push identity requires a configured area account" };
-  const probe = provider === "gitlab" ? ["api", "user", "--jq", ".username"] : ["api", "user", "--jq", ".login"];
-  const bin = provider === "gitlab" ? "glab" : "gh";
-  let login;
-  try {
-    login = execFileSync2(bin, [...probe], {
-      cwd: root,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-  } catch {
-    return { ok: false, error: `${bin} identity could not be resolved` };
-  }
-  if (!login || login.toLowerCase() !== account.toLowerCase())
+  const identity = vcsCliIdentity(root);
+  if (!identity.ok || identity.provider !== provider)
+    return { ok: false, error: identity.error ?? "hosting CLI identity could not be resolved" };
+  if (identity.username?.toLowerCase() !== account.toLowerCase())
     return {
       ok: false,
-      error: `push identity ${login || "(unknown)"} does not match area account ${account}`
+      error: `push identity ${identity.username || "(unknown)"} does not match area account ${account}`
     };
   return { ok: true };
 };
@@ -23061,7 +23654,7 @@ var operationAutoClass = (operation) => typeof operation === "string" ? OPERATIO
 var digestOf = (configDirPath) => {
   try {
     const raw = readFileSync4(`${configDirPath}/workspaces.json`, "utf8");
-    return createHash3("sha256").update(raw).digest("hex");
+    return createHash4("sha256").update(raw).digest("hex");
   } catch {
     return null;
   }
@@ -23099,14 +23692,30 @@ var resolveAutoApproval = (root, dir = configDir()) => {
   };
 };
 var isStandingReceipt = (value) => typeof value === "object" && value !== null && value.kind === "standing";
-var standingApprovalLive = (root, receipt, cls, dir) => {
+var targetOf = (root, descriptor) => {
+  try {
+    const parsed = typeof descriptor === "string" ? JSON.parse(descriptor) : descriptor;
+    const cwd = parsed?.payload?.cwd;
+    if (cwd === undefined)
+      return root;
+    if (typeof cwd !== "string" || !path8.isAbsolute(cwd))
+      return null;
+    return realpathSync3(cwd);
+  } catch {
+    return null;
+  }
+};
+var standingApprovalLive = (root, receipt, cls, dir, descriptor) => {
   if (!isStandingReceipt(receipt))
     return false;
   if (typeof cls !== "string" || !AUTO_CLASSES.includes(cls))
     return false;
   if (receipt.class !== cls)
     return false;
-  const resolved = resolveAutoApproval(root, dir);
+  const target = targetOf(root, descriptor);
+  if (!target)
+    return false;
+  const resolved = resolveAutoApproval(target, dir);
   if (resolved.status !== "on")
     return false;
   if (resolved.workspace !== receipt.workspace)
@@ -23142,16 +23751,19 @@ var verifyStandingApproval = (root, task, caller, binding) => {
   const cls = operationAutoClass(operation);
   if (!cls || cls !== standing.class)
     return failure("permission_denied", "standing approval does not cover this operation");
-  const resolved = resolveAutoApproval(root);
+  const target = targetOf(root, binding.approvedContent);
+  if (!target)
+    return failure("permission_denied", "standing action target is invalid");
+  const resolved = resolveAutoApproval(target);
   if (resolved.status !== "on" || resolved.workspace !== standing.workspace || !resolved.classes.includes(cls))
     return failure("permission_denied", "standing auto-approval is not live for this operation");
   if (cls === "push") {
-    const workspace = resolveWorkspaceFrom(root, configDir());
+    const workspace = resolveWorkspaceFrom(target, configDir());
     const provider = workspace?.vcs?.provider;
     const account = resolved.account;
     if (!provider || !account)
       return failure("permission_denied", "auto-push requires a workspace provider and area account");
-    const identity = verifyPushIdentity(root, provider, account);
+    const identity = verifyPushIdentity(target, provider, account);
     if (!identity.ok)
       return failure("permission_denied", identity.error);
   }
@@ -23160,7 +23772,7 @@ var verifyStandingApproval = (root, task, caller, binding) => {
     host: caller.host,
     session: { kind: "host", host: caller.host, handle: caller.actor },
     workerId: null,
-    receipts: [standingReceiptFor(root, standing.workspace, cls)]
+    receipts: [standingReceiptFor(target, standing.workspace, cls)]
   });
 };
 
@@ -23311,7 +23923,7 @@ function applicableDecision(task, purpose, binding, checkoutRoot) {
     return [];
   return task.decisions.filter((entry) => entry.provenance.kind !== "imported" && decisionMatches(entry, purpose, binding) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, entry.data.binding).ok : entry.data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map((entry) => entry.data);
 }
-var digestBytes2 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
+var digestBytes2 = (bytes) => createHash5("sha256").update(bytes).digest("hex");
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
@@ -23324,23 +23936,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure("invalid_input", "document references require a byte digest");
-    const target = path8.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path8.sep}`))
+    const target = path9.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path9.sep}`))
       return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const relative = path8.relative(root, target);
+      const relative = path9.relative(root, target);
       let current = root;
-      for (const segment of relative.split(path8.sep)) {
+      for (const segment of relative.split(path9.sep)) {
         if (!segment)
           continue;
-        current = path8.join(current, segment);
+        current = path9.join(current, segment);
         const stat = fs6.lstatSync(current);
         const real = fs6.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path8.sep}`))
+        if (real !== root && !real.startsWith(`${root}${path9.sep}`))
           return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -23418,7 +24030,7 @@ var validateAction = (store, task, workspaceId, input, authority) => {
       operation = null;
     }
     const cls = operationAutoClass(operation);
-    if (!cls || !standing.some((receipt) => standingApprovalLive(store.root, receipt, cls)))
+    if (!cls || !standing.some((receipt) => standingApprovalLive(store.root, receipt, cls, undefined, decision.binding.approvedContent)))
       return failure("permission_denied", "standing auto-approval is not live for this operation");
   }
   if (decision.revoked)
@@ -23720,15 +24332,15 @@ var bindingCovers = scopeCovers;
 var verifyDecisionContent = verifyContentRefs;
 
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes3 = (value) => createHash5("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path9.sep}`);
-var relative = (root, candidate) => path9.relative(root, candidate).split(path9.sep).join("/") || ".";
+var digestBytes3 = (value) => createHash6("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path10.sep}`);
+var relative = (root, candidate) => path10.relative(root, candidate).split(path10.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path9.posix.normalize(value);
+  const normalized = path10.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -23776,14 +24388,14 @@ var gitPaths = (root) => {
       git: /not a git repository/i.test(stderr) ? false : true
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path9.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")) : [];
   const stagedDeleted = spawnSync2("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path9.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
@@ -23798,7 +24410,7 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path9.join(directory, name);
+    const target = path10.join(directory, name);
     let stat;
     try {
       stat = fs7.lstatSync(target);
@@ -23816,12 +24428,12 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path9.resolve(root, item);
+    const target = path10.resolve(root, item);
     if (!inside(root, target))
       return failure("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
     while (!fs7.existsSync(ancestor) && ancestor !== root)
-      ancestor = path9.dirname(ancestor);
+      ancestor = path10.dirname(ancestor);
     try {
       if (!inside(root, fs7.realpathSync(ancestor)))
         return failure("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
@@ -23873,7 +24485,7 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].sort()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path9.join(checkout, item);
+    const target = path10.join(checkout, item);
     try {
       const stat = fs7.lstatSync(target);
       if (stat.isSymbolicLink()) {
@@ -24255,7 +24867,8 @@ var externalActionSchema = discriminatedUnion2("operation", [
       action: _enum2(["setup", "reapply_stash"]).optional(),
       sdd_dir: string5().optional(),
       target_branch: string5().optional(),
-      stash: _enum2(["yes", "no"]).optional()
+      stash: _enum2(["yes", "no"]).optional(),
+      cwd: string5().min(1).optional()
     }).strict()
   }).strict(),
   object4({
@@ -24263,12 +24876,13 @@ var externalActionSchema = discriminatedUnion2("operation", [
     payload: object4({
       message: string5().min(1).optional(),
       plan_steps: array3(chainStepSchema).min(1).max(32).optional(),
-      plan_branch: string5().min(1).optional()
+      plan_branch: string5().min(1).optional(),
+      cwd: string5().min(1).optional()
     }).strict()
   }).strict(),
   object4({
     operation: literal3("git.push"),
-    payload: object4({ branch: string5().min(1).optional() }).strict()
+    payload: object4({ branch: string5().min(1).optional(), cwd: string5().min(1).optional() }).strict()
   }).strict(),
   object4({
     operation: literal3("hosting.pull_request"),
@@ -24277,16 +24891,22 @@ var externalActionSchema = discriminatedUnion2("operation", [
       body: string5().optional(),
       draft: boolean5().optional(),
       target_branch: string5().optional(),
-      babysit: boolean5().optional()
+      babysit: boolean5().optional(),
+      cwd: string5().min(1).optional()
     }).strict()
   }).strict(),
   object4({
     operation: literal3("hosting.merge"),
     payload: object4({
       target_branch: string5().min(1).optional(),
-      source_branch: string5().min(1).optional()
+      source_branch: string5().min(1).optional(),
+      cwd: string5().min(1).optional()
     }).strict()
   }).strict(),
+  object4({
+    operation: literal3("hosting.delete_branch"),
+    payload: object4({ branch: string5().min(1), cwd: string5().min(1).optional() }).strict()
+  }).strict(),
   object4({
     operation: literal3("youtrack.update"),
     payload: object4({
@@ -24342,12 +24962,13 @@ var externalActionSchema = discriminatedUnion2("operation", [
       issueRef: string5().optional(),
       mode: string5().optional(),
       specPath: string5().optional(),
-      planPath: string5().optional()
+      planPath: string5().optional(),
+      cwd: string5().min(1).optional()
     }).strict()
   }).strict()
 ]);
 // packages/workit-core/src/core/task-engine.ts
-import { realpathSync as realpathSync5 } from "node:fs";
+import { realpathSync as realpathSync6 } from "node:fs";
 
 // packages/workit-core/src/core/policy-resolver.ts
 var resolverInputSchema = object4({
@@ -24520,6 +25141,7 @@ function resolveRequirements(input) {
       dependentAction: null,
       acceptanceAllowed: false
     }));
+  const independentBehaviorReview = input.preferences?.thorough === true || input.assessment.consequences.some((consequence) => ["security", "data", "public_contract", "operations"].includes(consequence.area));
   if (signals.behaviorChange.value === true)
     requirements.push(requirement({
       ruleId: "behavioral-verification",
@@ -24531,14 +25153,14 @@ function resolveRequirements(input) {
       dependentAction: null,
       acceptanceAllowed: false
     }), requirement({
-      ruleId: "fresh-context-review",
+      ruleId: independentBehaviorReview ? "fresh-context-review" : "self-review",
       dimension: "review",
       scope,
-      reason: "A non-mechanical behavior change requires fresh-context review.",
-      satisfaction: "A separate review context examines the current candidate and records its result.",
+      reason: independentBehaviorReview ? "Consequential behavior or the thorough preference requires fresh-context review." : "Bounded behavior changes use self-review unless consequential risks or trusted rules require more.",
+      satisfaction: independentBehaviorReview ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
       before: "close",
       dependentAction: null,
-      acceptanceAllowed: false
+      acceptanceAllowed: !independentBehaviorReview
     }));
   else if (signals.mechanicalLowRisk.value === true)
     requirements.push(requirement({
@@ -24892,6 +25514,18 @@ var portableTask = (task) => {
   };
   for (const entry of clone.assessments)
     demote(entry.data.facts, entry.data.signals, entry.data.consequences);
+  const sourceDecisions = new Map(task.decisions.map((entry) => [entry.id, entry]));
+  for (const entry of clone.decisions) {
+    const consumption = sourceDecisions.get(entry.id)?.data.consumption;
+    if (!consumption)
+      continue;
+    entry.data.consumption = {
+      ...consumption,
+      state: consumption.state === "reserved" ? "uncertain" : consumption.state,
+      actionRef: { kind: "record", collection: "decisions", id: entry.id },
+      ...consumption.historicalActionId ? { historicalActionId: consumption.historicalActionId } : consumption.actionRef.kind === "host" ? { historicalActionId: consumption.actionRef.handle } : {}
+    };
+  }
   clone.candidates = [];
   return clone;
 };
@@ -25017,7 +25651,11 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
             taskId: "",
             workspaceId: destinationWorkspaceId
           },
-          consumption: null
+          consumption: data.consumption ? {
+            ...data.consumption,
+            state: data.consumption.state === "reserved" ? "uncertain" : data.consumption.state,
+            actionRef: { kind: "record", collection: "decisions", id: entry.id }
+          } : null
         }
       };
     }),
@@ -25058,7 +25696,7 @@ class WorkitCore {
   }
   contextRootError() {
     try {
-      if (realpathSync5(this.context.root) !== this.store.root)
+      if (realpathSync6(this.context.root) !== this.store.root)
         return failure("invalid_input", "operation context root does not match the task store root");
     } catch {
       return failure("invalid_input", "operation context root cannot be resolved");
@@ -25217,7 +25855,7 @@ class WorkitCore {
       return parsed;
     const input = parsed.data;
     if ((this.context.workerId ?? null) !== null) {
-      if (input.action !== "inspect")
+      if (input.action !== "inspect" && input.action !== "list")
         return failure("permission_denied", "helpers cannot control task lifecycle or scope");
     }
     switch (input.action) {
@@ -25244,7 +25882,18 @@ class WorkitCore {
           return listed;
         const status = input.status ?? "open";
         const limit = input.limit ?? 20;
-        const selected = listed.data.filter((task) => status === "all" ? true : status === "closed" ? task.status === "closed" : task.status !== "closed").sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, limit);
+        const query = input.query?.toLowerCase().split(/\s+/);
+        const selected = listed.data.filter((task) => status === "all" ? true : status === "closed" ? task.status === "closed" : task.status !== "closed").filter((task) => !query || query.every((term) => JSON.stringify({
+          id: task.id,
+          workspaceId: task.workspaceId,
+          origin: task.origin,
+          createdAt: task.createdAt,
+          updatedAt: task.updatedAt,
+          source: task.intent.provenance,
+          objective: task.intent.data.objective,
+          progress: task.progress,
+          decisions: task.decisions.map(({ data }) => data)
+        }).toLowerCase().includes(term))).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, limit);
         if (selected.length === 0)
           return success(null, null, []);
         const workspace = this.store.readWorkspace();
@@ -25263,7 +25912,11 @@ class WorkitCore {
           status: task.status,
           closure: task.closure,
           progress: task.progress,
-          writer: task.status === "closed" ? null : workspace.data.writer
+          writer: task.status === "closed" ? null : workspace.data.writer,
+          source: {
+            host: task.intent.provenance.host,
+            kind: task.intent.provenance.kind
+          }
         }));
         return success(null, null, tasks);
       }
@@ -26359,7 +27012,7 @@ class WorkitCore {
     if (view.task.workspaceId !== view.workspace.id)
       return failure("invalid_input", "task and workspace bindings are invalid");
     try {
-      if (realpathSync5(view.workspace.root) !== this.store.root)
+      if (realpathSync6(view.workspace.root) !== this.store.root)
         return failure("invalid_input", "task view root does not match the task store");
     } catch {
       return failure("invalid_input", "task view root cannot be resolved");
@@ -26636,22 +27289,22 @@ function resolveGitRevision(root, value) {
   }
 }
 function resolveInside(root, candidate) {
-  const base = realpathSync6(root);
-  const target = path10.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path10.sep)) {
+  const base = realpathSync7(root);
+  const target = path11.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path11.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
   while (!existsSync5(ancestor))
-    ancestor = path10.dirname(ancestor);
-  const canonicalAncestor = realpathSync6(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path10.sep)) {
+    ancestor = path11.dirname(ancestor);
+  const canonicalAncestor = realpathSync7(ancestor);
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path11.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
 }
 function run2(root, executable, args, env = {}) {
-  const cwd = realpathSync6(root);
+  const cwd = realpathSync7(root);
   const result = spawnSync3(executable, args, {
     cwd,
     encoding: "utf8",
@@ -26724,18 +27377,19 @@ var redactSecrets = (value) => applyPatterns(value);
 
 // packages/workit-core/src/core/pr-create.ts
 import fs8 from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
 function parseGhIssue(value) {
   const m = /issues\/(\d+)/.exec(value);
   return m ? m[1] : String(value).trim().replace(/^#/, "");
 }
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path11.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path12.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path11.join(dir, name);
+      const candidate = path12.join(dir, name);
       try {
         fs8.accessSync(candidate, fs8.constants.X_OK);
         return candidate;
@@ -26745,11 +27399,21 @@ function whichOnPath(tool) {
   return null;
 }
 var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
+var pushRemote = (cwd) => {
+  const result = spawnSync4("git", ["remote", "get-url", "--push", "--all", "origin"], {
+    cwd,
+    encoding: "utf8"
+  });
+  if (result.status !== 0)
+    return null;
+  const urls = (result.stdout ?? "").split(/\r?\n/u).map((url) => url.trim()).filter(Boolean);
+  return urls.length === 1 ? urls[0] : null;
+};
 
 // packages/workit-core/src/core/repo-context.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync7, readdirSync as readdirSync4 } from "node:fs";
-import path12 from "node:path";
+import path13 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -26776,7 +27440,7 @@ var invalidRange = (cwd) => ({
   cwd
 });
 var runGit = (cwd, args) => {
-  const result = spawnSync4("git", args, { cwd, encoding: "utf8" });
+  const result = spawnSync5("git", args, { cwd, encoding: "utf8" });
   return {
     stdout: (result.stdout ?? "").trimEnd(),
     stderr: (result.stderr ?? "").trimEnd(),
@@ -26883,7 +27547,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path12.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path13.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -26914,7 +27578,7 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path12.join(cwd, "package.json");
+  const pkgPath = path13.join(cwd, "package.json");
   if (!existsSync6(pkgPath))
     return [];
   try {
@@ -26940,9 +27604,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path12.join(dir, entry.name), depth + 1);
+        walk(path13.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path12.relative(cwd, path12.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path13.relative(cwd, path13.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -26958,7 +27622,7 @@ var readTrimmed = (file, maxLines) => {
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path12.resolve(repoRoot(root));
+  const cwd = path13.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -27016,7 +27680,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 
 `;
-    stdout += readTrimmed(path12.join(cwd, template), 220);
+    stdout += readTrimmed(path13.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
 
@@ -27026,7 +27690,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync6(path12.join(cwd, "package.json"))) {
+  if (existsSync6(path13.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -27035,7 +27699,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync6(path12.join(cwd, "Cargo.toml")) || existsSync6(path12.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync6(path13.join(cwd, "Cargo.toml")) || existsSync6(path13.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -27068,7 +27732,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the native workit_changelog_apply tool only (not hand-edits under Unreleased).
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path12.resolve(repoRoot(root));
+  const cwd = path13.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -27086,7 +27750,7 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path12.join(cwd, "CHANGELOG.md");
+  const changelogPath = path13.join(cwd, "CHANGELOG.md");
   if (existsSync6(changelogPath)) {
     stdout += readTrimmed(changelogPath, 260) + `
 `;
@@ -27106,7 +27770,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path12.resolve(repoRoot(root));
+  const cwd = path13.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -27128,7 +27792,7 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path12.join(cwd, "README.md");
+  const readme = path13.join(cwd, "README.md");
   if (existsSync6(readme)) {
     stdout += readTrimmed(readme, 220) + `
 `;
@@ -27137,7 +27801,7 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path12.join(cwd, "package.json");
+  const pkgPath = path13.join(cwd, "package.json");
   if (existsSync6(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
@@ -27151,7 +27815,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path12.resolve(repoRoot(root));
+  const cwd = path13.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -27189,7 +27853,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync6(path12.join(cwd, rel)))
+    if (existsSync6(path13.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -27217,19 +27881,7 @@ function releaseNotesContext(root, rangeOrTag) {
 }
 
 // packages/workit-core/src/core/tracker-issues.ts
-import fs9 from "node:fs";
-import { spawnSync as spawnSync5 } from "node:child_process";
-var trackerRequest = async (url, init) => {
-  try {
-    const res = await fetch(url, { method: init.method, headers: init.headers });
-    const text = await res.text();
-    if (!res.ok)
-      return { status: res.status, stdout: "", stderr: text.slice(0, 200) };
-    return { status: 0, stdout: text, stderr: "" };
-  } catch (err) {
-    return { status: 1, stdout: "", stderr: err instanceof Error ? err.message : "network error" };
-  }
-};
+import { spawnSync as spawnSync6 } from "node:child_process";
 var repoPathFromRemote = (remote) => {
   let rest = (remote || "").trim().replace(/\/+$/, "");
   if (!rest)
@@ -27250,7 +27902,11 @@ var defaultCli = (bin, available) => {
   if (!available)
     return null;
   return (args, root) => {
-    const out = spawnSync5(bin, args, { cwd: root, encoding: "utf8" });
+    const out = spawnSync6(bin, args, {
+      cwd: root,
+      encoding: "utf8",
+      env: { ...process.env, PATH: process.env.PATH ?? "" }
+    });
     return Promise.resolve({
       status: out.status ?? 1,
       stdout: out.stdout ?? "",
@@ -27258,49 +27914,22 @@ var defaultCli = (bin, available) => {
     });
   };
 };
-var tryCliTriple = async (cli, args, root, id, idKeys, bodyKeys) => {
+var tryCliTriple = async (cli, name, args, root, id, idKeys, bodyKeys) => {
   if (!cli)
-    return null;
+    return { error: `${name} CLI is unavailable`, kind: "creds" };
   const run = cli(args, root);
   if (!run)
-    return null;
+    return { error: `${name} CLI is unavailable`, kind: "creds" };
   const out = await run;
   if (out.status !== 0)
-    return null;
+    return { error: `${name} CLI is not authenticated or the issue is unavailable`, kind: "creds" };
   try {
-    return parseTriple(JSON.parse(out.stdout), id, idKeys, bodyKeys);
+    const triple = parseTriple(JSON.parse(out.stdout), id, idKeys, bodyKeys);
+    return triple ? { data: triple } : { error: `unexpected ${name} issue response`, kind: "request" };
   } catch {
-    return null;
+    return { error: `invalid ${name} issue response`, kind: "request" };
   }
 };
-var originRemote = (root) => {
-  const out = spawnSync5("git", ["remote", "get-url", "origin"], { cwd: root, encoding: "utf8" });
-  return out.status === 0 ? (out.stdout ?? "").trim() || null : null;
-};
-var trackerCreds = (root, provider) => {
-  const cfg = vcsConfig("load", root);
-  if (!cfg || cfg.provider !== provider || typeof cfg.tokenPath !== "string" || !cfg.tokenPath)
-    return { error: `unconfigured ${provider} provider` };
-  let token = "";
-  try {
-    token = fs9.readFileSync(cfg.tokenPath, "utf8").trim();
-  } catch {
-    return { error: `missing ${provider} token` };
-  }
-  if (!token)
-    return { error: `empty ${provider} token file` };
-  if (provider === "gitlab") {
-    const gitlab = cfg.gitlab;
-    const apiUrl = String(gitlab?.apiUrl ?? "https://gitlab.com/api/v4").replace(/\/+$/, "");
-    return { token, api: apiUrl };
-  }
-  const github = cfg.github;
-  const host = String(github?.host ?? "github.com").toLowerCase();
-  return {
-    token,
-    api: host === "github.com" ? "https://api.github.com" : `https://${host}/api/v3`
-  };
-};
 var parseTriple = (parsed, id, idKeys, bodyKeys) => {
   const title = parsed.title;
   if (typeof title !== "string")
@@ -27323,62 +27952,36 @@ var fetchGitHubIssueBody = async (ref, root, deps = {}) => {
   const id = parseGhIssue(ref);
   if (!/^\d+$/.test(id))
     return { error: `invalid GitHub issue ref "${ref}"`, kind: "input" };
-  const repo = repoPathFromRemote((deps.remote ?? originRemote)(root) ?? "");
+  const remote = (deps.remote ?? pushRemote)(root);
+  const repo = repoPathFromRemote(remote ?? "");
   if (!repo)
     return { error: "no origin remote to resolve the repository", kind: "input" };
-  const viaCli = await tryCliTriple(deps.cli ?? defaultCli("gh", hostingCliAvailable("github")), ["issue", "view", id, "--repo", repo, "--json", "number,title,body,state"], root, id, ["number"], ["body"]);
-  if (viaCli)
-    return { data: viaCli };
-  const credentials = (deps.creds ?? ((r) => trackerCreds(r, "github")))(root);
-  if ("error" in credentials)
-    return { ...credentials, kind: "creds" };
-  const out = await (deps.request ?? trackerRequest)(`${credentials.api}/repos/${repo}/issues/${id}`, {
-    method: "GET",
-    headers: {
-      Authorization: `Bearer ${credentials.token}`,
-      Accept: "application/vnd.github+json"
-    }
-  });
-  if (out.status !== 0)
-    return { error: out.stderr || "GitHub issue fetch failed", kind: "request" };
-  try {
-    const triple = parseTriple(JSON.parse(out.stdout), id, ["number"], ["body"]);
-    if (!triple)
-      return { error: "unexpected GitHub issue shape", kind: "request" };
-    return { data: triple };
-  } catch {
-    return { error: "invalid GitHub issue response", kind: "request" };
-  }
+  const cfg = vcsConfig("load", root);
+  const host = (deps.host ?? (cfg.ok && cfg.provider === "github" ? cfg.github?.host : null) ?? "github.com").toLowerCase();
+  if (!remote || !hostingApiHostMatches(remote, host))
+    return { error: "hosting API host does not match the push destination", kind: "input" };
+  const repoArg = host === "github.com" ? repo : `${host}/${repo}`;
+  return tryCliTriple(deps.cli ?? defaultCli("gh", hostingCliAvailable("github")), "gh", ["issue", "view", id, "--repo", repoArg, "--json", "number,title,body,state"], root, id, ["number"], ["body"]);
 };
 var fetchGitLabIssueBody = async (ref, root, deps = {}) => {
   const id = parseGhIssue(ref);
   if (!/^\d+$/.test(id))
     return { error: `invalid GitLab issue ref "${ref}"`, kind: "input" };
-  const repo = repoPathFromRemote((deps.remote ?? originRemote)(root) ?? "");
+  const remote = (deps.remote ?? pushRemote)(root);
+  const repo = repoPathFromRemote(remote ?? "");
   if (!repo)
     return { error: "no origin remote to resolve the project", kind: "input" };
-  const viaCli = await tryCliTriple(deps.cli ?? defaultCli("glab", hostingCliAvailable("gitlab")), ["issue", "view", id, "-R", repo, "-F", "json"], root, id, ["iid"], ["description"]);
-  if (viaCli)
-    return { data: viaCli };
-  const credentials = (deps.creds ?? ((r) => trackerCreds(r, "gitlab")))(root);
-  if ("error" in credentials)
-    return { ...credentials, kind: "creds" };
-  const out = await (deps.request ?? trackerRequest)(`${credentials.api}/projects/${encodeURIComponent(repo)}/issues/${id}`, { method: "GET", headers: { "PRIVATE-TOKEN": credentials.token } });
-  if (out.status !== 0)
-    return { error: out.stderr || "GitLab issue fetch failed", kind: "request" };
-  try {
-    const triple = parseTriple(JSON.parse(out.stdout), id, ["iid"], ["description"]);
-    if (!triple)
-      return { error: "unexpected GitLab issue shape", kind: "request" };
-    return { data: triple };
-  } catch {
-    return { error: "invalid GitLab issue response", kind: "request" };
-  }
+  const cfg = vcsConfig("load", root);
+  const host = (deps.host ?? (cfg.ok && cfg.provider === "gitlab" ? cfg.gitlab?.host : null) ?? "gitlab.com").toLowerCase();
+  if (!remote || !hostingApiHostMatches(remote, host))
+    return { error: "hosting API host does not match the push destination", kind: "input" };
+  const repoArg = host === "gitlab.com" ? repo : `https://${host}/${repo}`;
+  return tryCliTriple(deps.cli ?? defaultCli("glab", hostingCliAvailable("gitlab")), "glab", ["issue", "view", id, "-R", repoArg, "-F", "json"], root, id, ["iid"], ["description"]);
 };
 
 // packages/workit-core/src/core/youtrack.ts
-import fs10 from "node:fs";
-import path13 from "node:path";
+import fs9 from "node:fs";
+import path14 from "node:path";
 
 // packages/workit-core/src/core/templates.ts
 var repoRoot2 = assetRoot();
@@ -27390,23 +27993,23 @@ var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
-var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path13.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path13.join(resolveConfigDir(), "youtrack.json");
+var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path14.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path14.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
-  const mode = fs10.statSync(p).mode & 511;
+  const mode = fs9.statSync(p).mode & 511;
   return mode === 384;
 };
 function readYouTrackConfig(required) {
   const cfgPath = youTrackConfigPath();
-  if (!fs10.existsSync(cfgPath)) {
+  if (!fs9.existsSync(cfgPath)) {
     return required ? { error: "ERROR: missing youtrack.json", path: cfgPath } : { config: {}, path: cfgPath };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs10.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs9.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: `${cfgPath} is not valid JSON`, path: cfgPath };
   }
@@ -27417,11 +28020,11 @@ function readYouTrackConfig(required) {
 }
 var readYouTrackContextConfig = () => {
   const cfgPath = youTrackReadOnlyConfigPath();
-  if (!fs10.existsSync(cfgPath))
+  if (!fs9.existsSync(cfgPath))
     return { data: {} };
   let parsed;
   try {
-    parsed = JSON.parse(fs10.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs9.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: "YouTrack configuration is unavailable" };
   }
@@ -27446,12 +28049,12 @@ function youTrackGreeting(configOverride) {
   const cfgPath = configOverride ?? youTrackConfigPath();
   let parsed;
   try {
-    parsed = JSON.parse(fs10.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs9.readFileSync(cfgPath, "utf8"));
   } catch {
     return {
       stdout: "",
       exitCode: 1,
-      stderr: fs10.existsSync(cfgPath) ? `${cfgPath} is not valid JSON` : `missing youtrack.json: ${cfgPath}`
+      stderr: fs9.existsSync(cfgPath) ? `${cfgPath} is not valid JSON` : `missing youtrack.json: ${cfgPath}`
     };
   }
   if (!isConfigObject(parsed)) {
@@ -27497,15 +28100,15 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path13.isAbsolute(tokenFile) ? path13.resolve(tokenFile) : path13.resolve(process.cwd(), tokenFile) : "";
-  if (!tokenPath || !fs10.existsSync(tokenPath))
+  const tokenPath = tokenFile ? path14.isAbsolute(tokenFile) ? path14.resolve(tokenFile) : path14.resolve(process.cwd(), tokenFile) : "";
+  if (!tokenPath || !fs9.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
     return { error: "youtrack.token mode must be 0600" };
-  const token = fs10.readFileSync(tokenPath, "utf8").trim();
+  const token = fs9.readFileSync(tokenPath, "utf8").trim();
   if (!token)
     return { error: "empty token file" };
-  if (token === TOKEN_PLACEHOLDER2 || token.startsWith(TOKEN_PLACEHOLDER2)) {
+  if (token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER)) {
     return {
       error: "token file still has placeholder YOUR_TOKEN_HERE — edit the file locally, then run /wk-status"
     };
@@ -27568,9 +28171,9 @@ function resolveYouTrackFromPaths(spec_path, plan_path, workspace_root) {
     } catch {
       continue;
     }
-    if (!fs10.existsSync(full))
+    if (!fs9.existsSync(full))
       continue;
-    const text = fs10.readFileSync(full, "utf8");
+    const text = fs9.readFileSync(full, "utf8");
     const m = text.match(/^\*\*YouTrack:\*\*\s*`?([A-Z]+-\d+)`?/m);
     if (m)
       return m[1];
@@ -27804,6 +28407,7 @@ var readExternalContext = async (root, payload) => {
     }
   }
 };
+var targetWriterActionLease = Symbol("target-writer-action-lease");
 
 // packages/workit-mcp/src/server.ts
 class McpCapabilityUnavailableError extends Error {
@@ -27848,13 +28452,13 @@ var rootVariants = (workspaceRoot) => {
   if (!workspaceRoot)
     return [];
   const roots = new Set;
-  for (const candidate of [workspaceRoot, path14.resolve(workspaceRoot)]) {
-    if (path14.isAbsolute(candidate) && candidate !== path14.parse(candidate).root)
+  for (const candidate of [workspaceRoot, path15.resolve(workspaceRoot)]) {
+    if (path15.isAbsolute(candidate) && candidate !== path15.parse(candidate).root)
       roots.add(candidate);
   }
   try {
-    const canonical = realpathSync7(workspaceRoot);
-    if (canonical !== path14.parse(canonical).root)
+    const canonical = realpathSync8(workspaceRoot);
+    if (canonical !== path15.parse(canonical).root)
       roots.add(canonical);
   } catch {}
   return [...roots].sort((left, right) => right.length - left.length);
@@ -27955,11 +28559,11 @@ var thrownResult = (tool, error, workspaceRoot) => {
 };
 function createMcpServer(host, contextProvider) {
   assertMcpHost(host);
-  const here = path14.dirname(fileURLToPath2(import.meta.url));
+  const here = path15.dirname(fileURLToPath2(import.meta.url));
   const sourceMarker = markSourcesLoaded([
-    path14.join(here, "server.ts"),
-    path14.join(here, "..", "..", "workit-core", "src", "core", "task-contract.ts"),
-    path14.join(here, "..", "..", "workit-core", "src", "core", "task-engine.ts")
+    path15.join(here, "server.ts"),
+    path15.join(here, "..", "..", "workit-core", "src", "core", "task-contract.ts"),
+    path15.join(here, "..", "..", "workit-core", "src", "core", "task-engine.ts")
   ].filter((file) => existsSync7(file)));
   let staleWarned = false;
   const server = new Server({ name: "workit", version: VERSION }, { capabilities: { tools: {}, resources: {} } });
@@ -28139,8 +28743,8 @@ var main = async () => {
     process.exitCode = 2;
   }
 };
-var entryPath = process.argv[1] ? path15.resolve(process.argv[1]) : "";
-if (entryPath === path15.resolve(fileURLToPath3(import.meta.url)))
+var entryPath = process.argv[1] ? path16.resolve(process.argv[1]) : "";
+if (entryPath === path16.resolve(fileURLToPath3(import.meta.url)))
   await main();
 export {
   McpCapabilityUnavailableError,