@brainervirus/workit-opencode 1.1.1 → 1.2.1

package/dist/plugin.js

@@ -13,10 +13,9 @@ var __export = (target, all) => {
     });
 };
 
-// packages/workit-opencode/src/plugin.ts
-import { existsSync as existsSync13 } from "node:fs";
-import path25 from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+// packages/workit-opencode/src/v1/server.ts
+import { existsSync as existsSync14 } from "node:fs";
+import path27 from "node:path";
 
 // packages/workit-core/src/core.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -5970,10 +5969,35 @@ var numberProcessor = (schema, ctx, _json, params) => {
 var booleanProcessor = (_schema, _ctx, json, _params) => {
   json.type = "boolean";
 };
+var bigintProcessor = (schema, ctx, json, params) => {
+  handleUnrepresentable(schema, ctx, json, params, "BigInt cannot be represented in JSON Schema");
+};
+var symbolProcessor = (schema, ctx, json, params) => {
+  handleUnrepresentable(schema, ctx, json, params, "Symbols cannot be represented in JSON Schema");
+};
+var nullProcessor = (_schema, ctx, json, _params) => {
+  if (ctx.target === "openapi-3.0") {
+    json.type = "string";
+    json.nullable = true;
+    json.enum = [null];
+  } else {
+    json.type = "null";
+  }
+};
+var undefinedProcessor = (schema, ctx, json, params) => {
+  handleUnrepresentable(schema, ctx, json, params, "Undefined cannot be represented in JSON Schema");
+};
+var voidProcessor = (schema, ctx, json, params) => {
+  handleUnrepresentable(schema, ctx, json, params, "Void cannot be represented in JSON Schema");
+};
 var neverProcessor = (_schema, _ctx, json, _params) => {
   json.not = {};
 };
+var anyProcessor = (_schema, _ctx, _json, _params) => {};
 var unknownProcessor = (_schema, _ctx, _json, _params) => {};
+var dateProcessor = (schema, ctx, json, params) => {
+  handleUnrepresentable(schema, ctx, json, params, "Date cannot be represented in JSON Schema");
+};
 var enumProcessor = (schema, _ctx, json, _params) => {
   const def = schema._zod.def;
   const values = getEnumValues(def.entries);
@@ -6026,12 +6050,59 @@ var literalProcessor = (schema, ctx, json, params) => {
     json.enum = vals;
   }
 };
+var nanProcessor = (schema, ctx, json, params) => {
+  handleUnrepresentable(schema, ctx, json, params, "NaN cannot be represented in JSON Schema");
+};
+var templateLiteralProcessor = (schema, _ctx, json, _params) => {
+  const _json = json;
+  const pattern = schema._zod.pattern;
+  if (!pattern)
+    throw new Error("Pattern not found in template literal");
+  _json.type = "string";
+  _json.pattern = pattern.source;
+};
+var fileProcessor = (schema, _ctx, json, _params) => {
+  const _json = json;
+  const file = {
+    type: "string",
+    format: "binary",
+    contentEncoding: "binary"
+  };
+  const { minimum, maximum, mime } = schema._zod.bag;
+  if (minimum !== undefined)
+    file.minLength = minimum;
+  if (maximum !== undefined)
+    file.maxLength = maximum;
+  if (mime) {
+    if (mime.length === 1) {
+      file.contentMediaType = mime[0];
+      Object.assign(_json, file);
+    } else {
+      Object.assign(_json, file);
+      _json.anyOf = mime.map((m) => ({ contentMediaType: m }));
+    }
+  } else {
+    Object.assign(_json, file);
+  }
+};
+var successProcessor = (_schema, _ctx, json, _params) => {
+  json.type = "boolean";
+};
 var customProcessor = (schema, ctx, json, params) => {
   handleUnrepresentable(schema, ctx, json, params, "Custom types cannot be represented in JSON Schema");
 };
+var functionProcessor = (schema, ctx, json, params) => {
+  handleUnrepresentable(schema, ctx, json, params, "Function types cannot be represented in JSON Schema");
+};
 var transformProcessor = (schema, ctx, json, params) => {
   handleUnrepresentable(schema, ctx, json, params, "Transforms cannot be represented in JSON Schema");
 };
+var mapProcessor = (schema, ctx, json, params) => {
+  handleUnrepresentable(schema, ctx, json, params, "Map cannot be represented in JSON Schema");
+};
+var setProcessor = (schema, ctx, json, params) => {
+  handleUnrepresentable(schema, ctx, json, params, "Set cannot be represented in JSON Schema");
+};
 var arrayProcessor = (schema, ctx, _json, params) => {
   const json = _json;
   const def = schema._zod.def;
@@ -6127,6 +6198,70 @@ var intersectionProcessor = (schema, ctx, json, params) => {
   json.allOf = allOf;
   ctx.intersections.push(allOf);
 };
+var tupleProcessor = (schema, ctx, _json, params) => {
+  const json = _json;
+  const def = schema._zod.def;
+  json.type = "array";
+  const prefixPath = ctx.target === "draft-2020-12" ? "prefixItems" : "items";
+  const restPath = ctx.target === "draft-2020-12" ? "items" : ctx.target === "openapi-3.0" ? "items" : "additionalItems";
+  const prefixItems = def.items.map((x, i) => process2(x, ctx, {
+    ...params,
+    path: [...params.path, prefixPath, i]
+  }));
+  const rest = def.rest ? process2(def.rest, ctx, {
+    ...params,
+    path: [...params.path, restPath, ...ctx.target === "openapi-3.0" ? [def.items.length] : []]
+  }) : null;
+  let minItems = def.items.length;
+  while (minItems > 0) {
+    const item = def.items[minItems - 1];
+    const optional = ctx.io === "input" ? inputOptin(item) !== undefined : item._zod.optout === "optional";
+    if (!optional)
+      break;
+    minItems--;
+  }
+  const maxItems = def.items.length;
+  const isClosed = !def.rest;
+  if (ctx.target === "draft-2020-12") {
+    json.prefixItems = prefixItems;
+    if (isClosed) {
+      json.items = false;
+    } else if (rest) {
+      json.items = rest;
+    }
+    if (minItems > 0)
+      json.minItems = minItems;
+    if (isClosed)
+      json.maxItems = maxItems;
+  } else if (ctx.target === "openapi-3.0") {
+    json.items = {
+      anyOf: prefixItems
+    };
+    if (rest) {
+      json.items.anyOf.push(rest);
+    }
+    if (minItems > 0)
+      json.minItems = minItems;
+    if (isClosed)
+      json.maxItems = maxItems;
+  } else {
+    json.items = prefixItems;
+    if (isClosed) {
+      json.additionalItems = false;
+    } else if (rest) {
+      json.additionalItems = rest;
+    }
+    if (minItems > 0)
+      json.minItems = minItems;
+    if (isClosed)
+      json.maxItems = maxItems;
+  }
+  const { minimum, maximum } = schema._zod.bag;
+  if (typeof minimum === "number")
+    json.minItems = minimum;
+  if (typeof maximum === "number")
+    json.maxItems = maximum;
+};
 function stringifyKeyNames(bySchema, json, visited) {
   if (json.$ref) {
     if (visited.has(json))
@@ -6314,12 +6449,99 @@ var readonlyProcessor = (schema, ctx, json, params) => {
   seen.ref = def.innerType;
   json.readOnly = true;
 };
+var promiseProcessor = (schema, ctx, _json, params) => {
+  const def = schema._zod.def;
+  process2(def.innerType, ctx, params);
+  const seen = ctx.seen.get(schema);
+  seen.ref = def.innerType;
+};
 var optionalProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
   process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
+var lazyProcessor = (schema, ctx, _json, params) => {
+  const innerType = schema._zod.innerType;
+  process2(innerType, ctx, params);
+  const seen = ctx.seen.get(schema);
+  seen.ref = innerType;
+};
+var allProcessors = {
+  string: stringProcessor,
+  number: numberProcessor,
+  boolean: booleanProcessor,
+  bigint: bigintProcessor,
+  symbol: symbolProcessor,
+  null: nullProcessor,
+  undefined: undefinedProcessor,
+  void: voidProcessor,
+  never: neverProcessor,
+  any: anyProcessor,
+  unknown: unknownProcessor,
+  date: dateProcessor,
+  enum: enumProcessor,
+  literal: literalProcessor,
+  nan: nanProcessor,
+  template_literal: templateLiteralProcessor,
+  file: fileProcessor,
+  success: successProcessor,
+  custom: customProcessor,
+  function: functionProcessor,
+  transform: transformProcessor,
+  map: mapProcessor,
+  set: setProcessor,
+  array: arrayProcessor,
+  object: objectProcessor,
+  union: unionProcessor,
+  intersection: intersectionProcessor,
+  tuple: tupleProcessor,
+  record: recordProcessor,
+  nullable: nullableProcessor,
+  nonoptional: nonoptionalProcessor,
+  default: defaultProcessor,
+  prefault: prefaultProcessor,
+  catch: catchProcessor,
+  pipe: pipeProcessor,
+  readonly: readonlyProcessor,
+  promise: promiseProcessor,
+  optional: optionalProcessor,
+  lazy: lazyProcessor
+};
+function toJSONSchema(input, params) {
+  if ("_idmap" in input) {
+    const registry = input;
+    const ctx = initializeContext({ ...params, processors: allProcessors });
+    const defs = {};
+    for (const entry of registry._idmap.entries()) {
+      const [_, schema] = entry;
+      process2(schema, ctx);
+    }
+    const schemas = {};
+    const external = {
+      registry,
+      uri: params?.uri,
+      defs
+    };
+    ctx.external = external;
+    for (const entry of registry._idmap.entries()) {
+      const [key, schema] = entry;
+      extractDefs(ctx, schema);
+      assignProp(schemas, key, finalize(ctx, schema));
+    }
+    if (Object.keys(defs).length > 0) {
+      const defsSegment = ctx.target === "draft-2020-12" ? "$defs" : "definitions";
+      schemas.__shared = {
+        [defsSegment]: defs
+      };
+    }
+    return { schemas };
+  }
+  const ctx = initializeContext({ ...params, processors: allProcessors });
+  process2(input, ctx);
+  extractDefs(ctx, input);
+  return finalize(ctx, input);
+}
 // node_modules/zod/v4/classic/errors.js
 var _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
@@ -7743,6 +7965,7 @@ var workerSchema = object({
   assignment: assignmentSchema,
   state: _enum(["assigned", "dispatching", "running", "cancelling", "stopped", "unknown"]),
   session: refSchema.nullable(),
+  coordinator: refSchema.optional(),
   report: workerReportSchema.nullable()
 }).strict();
 var ownerSchema = object({
@@ -7854,6 +8077,7 @@ var taskSummarySchema = object({
   requirements: array(requirementEvaluationSchema),
   writer: workspaceRecordSchema.shape.writer
 }).strict();
+var taskListItemSchema = taskSummarySchema.omit({ policy: true, requirements: true });
 var exportBundleSchema = object({
   schemaVersion: literal(1),
   exportedAt: utc,
@@ -7875,11 +8099,15 @@ var taskOperations = {
     expectedWorkspaceRevision: revision.nullable().optional(),
     intent: intentSchema
   }),
-  list: operation({ action: literal("list") }),
+  list: operation({
+    action: literal("list"),
+    status: _enum(["open", "closed", "all"]).optional(),
+    limit: number2().int().min(1).max(50).optional()
+  }),
   inspect: operation({
     action: literal("inspect"),
     ...taskId,
-    view: _enum(["summary", "full"])
+    view: _enum(["summary", "full"]).optional()
   }),
   revise: operation({
     action: literal("revise"),
@@ -7907,7 +8135,7 @@ var taskOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    authorityRefs: array(refSchema)
+    authorityRefs: array(refSchema).optional()
   }),
   close: operation({
     action: literal("close"),
@@ -8070,8 +8298,62 @@ function parseOperation(family, input) {
   }));
   return failure("invalid_input", "operation input is invalid", { fields });
 }
+function operationJsonSchema(family) {
+  return toJSONSchema(operationSchemas[family], { target: "draft-2020-12" });
+}
 var OPERATION_SCHEMA_DEPTH = 1;
 var canonicalFieldsDescription = (fields) => `Canonical object fields: ${fields.join(", ")}. Workit validates the complete nested value.`;
+function boundedOperationJsonSchema(family, maxDepth = OPERATION_SCHEMA_DEPTH, stringifiedObjects = false) {
+  const tolerate = (projected) => {
+    if (!stringifiedObjects)
+      return projected;
+    if (projected.properties && typeof projected.properties === "object")
+      return { ...projected, type: ["object", "string"] };
+    if (projected.items)
+      return { ...projected, type: ["array", "string"] };
+    if ("const" in projected && (typeof projected.const === "number" || typeof projected.const === "boolean"))
+      return { anyOf: [projected, { const: String(projected.const) }] };
+    if (projected.type === "object")
+      return { ...projected, type: ["object", "string"] };
+    if (projected.type === "array")
+      return { ...projected, type: ["array", "string"] };
+    return projected;
+  };
+  const collapse = (node, currentDepth) => {
+    if (Array.isArray(node))
+      return node.map((item) => collapse(item, currentDepth));
+    if (typeof node !== "object" || node === null)
+      return node;
+    const record = node;
+    if (record.properties && typeof record.properties === "object") {
+      const fields = Object.keys(record.properties);
+      if (currentDepth >= maxDepth || fields.length === 0) {
+        const description = stringifiedObjects ? `${canonicalFieldsDescription(fields)} A JSON-encoded string is also accepted.` : canonicalFieldsDescription(fields);
+        return tolerate({ type: "object", description });
+      }
+      return tolerate({
+        ...record,
+        properties: Object.fromEntries(Object.entries(record.properties).map(([key, child]) => [
+          key,
+          collapse(child, currentDepth + 1)
+        ]))
+      });
+    }
+    if (record.items)
+      return tolerate({ ...record, items: collapse(record.items, currentDepth) });
+    const composed = ["anyOf", "oneOf", "allOf"].filter((key) => Array.isArray(record[key]));
+    if (composed.length > 0) {
+      const projected = { ...record };
+      for (const key of composed)
+        projected[key] = record[key].map((item) => collapse(item, currentDepth));
+      return projected;
+    }
+    if ("const" in record)
+      return tolerate({ ...record });
+    return node;
+  };
+  return collapse(operationJsonSchema(family), 0);
+}
 function canonical(value, seen) {
   if (value === null || typeof value === "boolean" || typeof value === "string") {
     if (typeof value === "string" && invalidUnicode(value))
@@ -9686,6 +9968,10 @@ var validPath = (value) => typeof value === "string" && value.length > 0 && ![..
 }) && !value.split(/[\\/]/).includes("..");
 var callerValue = (value) => ({ host: value.host, actor: value.actor });
 var workerIdOf = (value) => value.workerId ?? null;
+var currentWriterOwnsTask = (task, workspace, caller) => {
+  const owner = workspace.writer?.owner;
+  return task.status === "active" && task.workspaceId === workspace.id && owner?.taskId === task.id && owner.session.host === caller.host && owner.session.handle === caller.actor;
+};
 function assertProductWriteAllowed(input) {
   if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
     return failure("invalid_input", "invalid product write path");
@@ -10868,9 +11154,11 @@ var standingReceiptFor = (root, workspace, cls, dir) => {
 var verifyStandingApproval = (root, task, caller, binding) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
-  const session = task.intent?.provenance?.session;
-  if (!session || session.kind !== "host" || session.host !== caller.host || session.handle !== caller.actor)
-    return failure("permission_denied", "standing approval requires the lead session");
+  const workspace = new TaskStore(root).readWorkspace();
+  if (!workspace.ok)
+    return workspace;
+  if (!workspace.data || !currentWriterOwnsTask(task, workspace.data, caller))
+    return failure("permission_denied", "standing approval requires the current writer session");
   const standing = binding.standing;
   if (!standing || typeof standing.workspace !== "string" || typeof standing.class !== "string")
     return failure("invalid_input", "standing approval needs a workspace and class");
@@ -10918,14 +11206,14 @@ var standingAutoApplies = (store, host, actor, operation) => {
   const workspace = store.readWorkspace();
   if (!listed.ok || !workspace.ok || !workspace.data)
     return null;
-  const matches = listed.data.filter((task) => task.status === "active" && task.workspaceId === workspace.data.id && task.intent?.provenance?.session?.kind === "host" && task.intent.provenance.session.host === host && task.intent.provenance.session.handle === actor);
-  if (matches.length !== 1)
+  const task = listed.data.find((task) => currentWriterOwnsTask(task, workspace.data, { host, actor }));
+  if (!task)
     return null;
   const resolved = resolveAutoApproval(store.root);
   if (resolved.status !== "on")
     return null;
   return {
-    task: matches[0],
+    task,
     workspaceId: workspace.data.id,
     workspaceRevision: workspace.data.revision,
     cls,
@@ -11184,6 +11472,20 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
 };
 var verifyContentRefs = (store, binding) => verifyDecisionContentAtRoot(store.root, binding);
 var storedDecisionApplicable = (store, task, purpose, binding) => task.decisions.filter((entry) => entry.provenance.kind !== "imported" && decisionMatches(entry, purpose, binding) && verifyDecisionContentAtRoot(store.root, entry.data.binding).ok);
+var approvalAuthorityMatches = (store, task, approval, current) => {
+  if (approval.kind !== "host_observed" || approval.receipts.length === 0)
+    return false;
+  if (provenanceMatches(approval, current))
+    return true;
+  const session = current.kind === "host_observed" ? current.session : null;
+  if (!session || session.kind !== "host")
+    return false;
+  const workspace = store.readWorkspace();
+  return workspace.ok && workspace.data !== null && currentWriterOwnsTask(task, workspace.data, {
+    host: session.host,
+    actor: session.handle
+  });
+};
 var validateAction = (store, task, workspaceId, input, authority) => {
   if (task.status !== "active")
     return failure("invalid_transition", "only active tasks can authorize actions");
@@ -11209,7 +11511,7 @@ var validateAction = (store, task, workspaceId, input, authority) => {
     return failure("permission_denied", "native reservation authority does not match decision");
   if (decision.response !== "approved")
     return failure("permission_denied", "decision was rejected");
-  if (entry.provenance.kind !== "host_observed" || entry.provenance.receipts.length === 0 || !provenanceMatches(entry.provenance, authority.provenance))
+  if (!approvalAuthorityMatches(store, task, entry.provenance, authority.provenance))
     return failure("permission_denied", "action approval lacks native receipt assurance");
   const receipts = entry.provenance.receipts;
   const standing = receipts.filter((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "standing");
@@ -11376,7 +11678,7 @@ function settleAction(input) {
       return failure("not_found", "decision not found");
     if (!authorityDecisionMatches(authority, entry.data))
       return failure("permission_denied", "native settlement authority does not match decision");
-    if (!provenanceMatches(entry.provenance, authority.provenance))
+    if (!approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native settlement caller does not match approval");
     if (entry.data.purpose !== "action" || entry.data.digest !== decisionDigest(entry.data))
       return failure("permission_denied", "decision binding is invalid");
@@ -11475,7 +11777,7 @@ function reconcileAction(input) {
     const entry = current.decisions.find((candidate) => candidate.id === input.decisionId);
     if (!entry || entry.data.purpose !== "action")
       return failure("not_found", "decision not found");
-    if (!authorityDecisionMatches(authority, entry.data) || !provenanceMatches(entry.provenance, authority.provenance))
+    if (!authorityDecisionMatches(authority, entry.data) || !approvalAuthorityMatches(input.store, current, entry.provenance, authority.provenance))
       return failure("permission_denied", "native reconciliation caller does not match approval");
     if (entry.data.response !== "approved" || entry.data.revoked !== null || entry.data.digest !== decisionDigest(entry.data) || entry.data.binding.taskId !== current.id || entry.data.binding.workspaceId !== current.workspaceId || entry.data.binding.workspaceId !== workspace.data.id)
       return failure("permission_denied", "reconciliation decision binding is invalid");
@@ -11812,7 +12114,7 @@ var resolveBinding = (evidence, pin, currentCandidateId) => {
     candidateId: evidence.candidateId ?? fallback
   };
 };
-var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId === findingCandidateId);
+var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId != null);
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
 var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
 var evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
@@ -12282,6 +12584,11 @@ function shouldDenyShellRoute(dir, command) {
 }
 // packages/workit-core/src/core/external-action.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
+var chainStepSchema = union([
+  string2().min(1),
+  object({ branch: string2().min(1) }).strict(),
+  object({ pr: literal(true) }).strict()
+]);
 var externalActionSchema = discriminatedUnion("operation", [
   object({
     operation: literal("git.branch_setup"),
@@ -12296,7 +12603,7 @@ var externalActionSchema = discriminatedUnion("operation", [
     operation: literal("git.commit"),
     payload: object({
       message: string2().min(1).optional(),
-      plan_steps: array(string2().min(1)).optional(),
+      plan_steps: array(chainStepSchema).min(1).max(32).optional(),
       plan_branch: string2().min(1).optional()
     }).strict()
   }).strict(),
@@ -12394,7 +12701,13 @@ var externalActionDescriptor = (operation, payload) => canonicalJson({
   payload,
   ...payload && typeof payload === "object" && !Array.isArray(payload) && "resolved" in payload && payload.resolved && typeof payload.resolved === "object" && Array.isArray(payload.resolved.steps) ? { steps: payload.resolved.steps } : {}
 });
-var externalActionHelp = "Fixed actions: git.branch_setup {action?,sdd_dir?,target_branch(required unless reapply_stash; the working branch to create or switch to),stash?}; git.commit {message}; git.push {branch?}; hosting.pull_request {title,body?,draft?,target_branch?,babysit?}; hosting.merge {target_branch?,source_branch?}; youtrack.update {issueId,markdown,minutes?}; youtrack.time {issueId,minutes,text?,dateMs?}; youtrack.meeting {issueId,minutes,text}; changelog.apply {entries?,path?,normalize_only?}; context.read {kind,range?,issueId?,issueUrl?,issueRef?,mode?,specPath?,planPath?}. context.read is read-only and needs no approval; all other operations require native approval (CLI uses a TTY; caller-unattested MCP cannot mutate).";
+var planReservationLength = (operation, descriptorPayload) => {
+  if (operation !== "git.commit")
+    return null;
+  const payload = descriptorPayload ?? {};
+  return Array.isArray(payload.plan_steps) ? payload.plan_steps.length : null;
+};
+var externalActionHelp = "Fixed actions: git.branch_setup {action?,sdd_dir?,target_branch(required unless reapply_stash; the working branch to create or switch to),stash?}; git.commit {message?; plan_steps?: (string | {branch:string} | {pr:true})[]; plan_branch?}; git.push {branch?}; hosting.pull_request {title,body?,draft?,target_branch?,babysit?}; hosting.merge {target_branch?,source_branch?}; youtrack.update {issueId,markdown,minutes?}; youtrack.time {issueId,minutes,text?,dateMs?}; youtrack.meeting {issueId,minutes,text}; changelog.apply {entries?,path?,normalize_only?}; context.read {kind: git|pr|youtrack|github_issue|gitlab_issue|changelog|release|affected,range?,issueId?,issueUrl?,issueRef?,mode?,specPath?,planPath?}. context.read is read-only and needs no approval; all other operations require native approval (CLI uses a TTY; caller-unattested MCP cannot mutate).";
 var externalActionRef = (host, actor, descriptor) => ({
   kind: "host",
   host,
@@ -12408,12 +12721,12 @@ var externalActionState = (store, host, actor, operation) => {
   if (!workspace.data)
     return failure("not_found", "workspace not found");
   const candidates = listed.data.flatMap((task) => {
-    if (task.status !== "active" || task.workspaceId !== workspace.data.id || task.intent.provenance.session?.kind !== "host" || task.intent.provenance.session.host !== host || task.intent.provenance.session.handle !== actor)
+    if (task.status !== "active" || task.workspaceId !== workspace.data.id)
       return [];
     return task.decisions.filter((entry) => entry.data.purpose === "action" && entry.data.response === "approved" && entry.data.revoked === null && entry.data.binding.approvedContent === operation).map((entry) => ({ task, entry }));
   });
   if (candidates.length !== 1)
-    return failure("permission_denied", candidates.length === 0 ? "no approved action is bound to this session" : "multiple approved actions match this session");
+    return failure("permission_denied", candidates.length === 0 ? "no approved action is bound to the active task" : "multiple approved actions match the active task");
   return success(workspace.data.revision, null, { ...candidates[0], workspace: workspace.data });
 };
 var priorExternalAction = (store, host, actor, operation, payload) => {
@@ -12493,8 +12806,6 @@ var approvedPlanCommit = (store, host, actor, message) => {
   const matches = listed.data.flatMap((task) => {
     if (task.status !== "active" || task.workspaceId !== workspace.data.id)
       return [];
-    if (task.intent.provenance.session?.kind !== "host" || task.intent.provenance.session.host !== host || task.intent.provenance.session.handle !== actor)
-      return [];
     return task.decisions.flatMap((entry) => {
       const decision = entry.data;
       if (decision.purpose !== "action" || decision.response !== "approved" || decision.revoked !== null)
@@ -12536,8 +12847,6 @@ var approvedChainStep = (store, host, actor, query) => {
   const matches = listed.data.flatMap((task) => {
     if (task.status !== "active" || task.workspaceId !== workspace.data.id)
       return [];
-    if (task.intent.provenance.session?.kind !== "host" || task.intent.provenance.session.host !== host || task.intent.provenance.session.handle !== actor)
-      return [];
     return task.decisions.flatMap((entry) => {
       const decision = entry.data;
       if (decision.purpose !== "action" || decision.response !== "approved" || decision.revoked !== null)
@@ -12694,7 +13003,7 @@ var branchSetupIntent = (descriptor) => {
 var approvedBranchSetupIntent = (store, host, actor, operation) => {
   const current = branchSetupIntent(operation);
   if (!current)
-    return failure("permission_denied", "no approved action is bound to this session");
+    return failure("permission_denied", "no approved action is bound to the active task");
   const listed = store.listTasks();
   const workspace = store.readWorkspace();
   if (!listed.ok || !workspace.ok)
@@ -12702,7 +13011,7 @@ var approvedBranchSetupIntent = (store, host, actor, operation) => {
   if (!workspace.data)
     return failure("not_found", "workspace not found");
   const candidates = listed.data.flatMap((task) => {
-    if (task.status !== "active" || task.workspaceId !== workspace.data.id || task.intent.provenance.session?.kind !== "host" || task.intent.provenance.session.host !== host || task.intent.provenance.session.handle !== actor)
+    if (task.status !== "active" || task.workspaceId !== workspace.data.id)
       return [];
     return task.decisions.filter((entry) => entry.data.purpose === "action" && entry.data.response === "approved" && entry.data.revoked === null).map((entry) => ({ task, entry }));
   });
@@ -12711,7 +13020,7 @@ var approvedBranchSetupIntent = (store, host, actor, operation) => {
     return intent !== null && intent.target === current.target && intent.base === current.base && intent.remoteBase === current.remoteBase && intent.targetExists === current.targetExists;
   });
   if (matches.length !== 1)
-    return failure("permission_denied", matches.length === 0 ? "no approved action is bound to this session" : "multiple approved actions match this session");
+    return failure("permission_denied", matches.length === 0 ? "no approved action is bound to the active task" : "multiple approved actions match the active task");
   return success(workspace.data.revision, null, { ...matches[0], workspace: workspace.data });
 };
 var priorResolvedDrift = (store, host, actor, operation, payload, currentResolved) => {
@@ -13268,6 +13577,7 @@ var verifyNativeWorker = (verifier, input, binding) => {
     expectedWorkspaceRevision: expected.expectedWorkspaceRevision,
     state: expected.state,
     session: expected.session,
+    report: expected.report ?? null,
     provenance: result.data,
     ...binding
   });
@@ -13278,7 +13588,7 @@ var takeWorker = (token, binding, expected) => {
   verifiedWorkers.delete(token);
   if (!value)
     return null;
-  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session))
+  if (value.owner !== binding.owner || value.store !== binding.store || value.root !== binding.root || value.root !== value.store.root || !sameValue(value.caller, binding.caller) || value.taskId !== expected.taskId || value.workerId !== expected.workerId || value.expectedRevision !== expected.expectedRevision || value.expectedWorkspaceRevision !== expected.expectedWorkspaceRevision || value.state !== expected.state || !sameValue(value.session, expected.session) || !sameValue(value.report, expected.report ?? null))
     return null;
   return value;
 };
@@ -13319,6 +13629,8 @@ var applyWorkerLifecycle = (input) => {
     return failure("invalid_transition", "worker already has an observed session");
   if (notStarted && !["dispatching", "cancelling"].includes(entry.data.state))
     return failure("invalid_transition", "worker launch was not claimed");
+  if (input.report && input.state !== "stopped")
+    return failure("invalid_input", "worker reports require a stopped worker");
   if ((input.state === "running" || input.state === "cancelling" || input.state === "stopped" && !notStarted) && !input.session)
     return failure("invalid_input", "running worker observations require a session");
   if (entry.data.session && !sameValue(entry.data.session, input.session))
@@ -13335,12 +13647,13 @@ var applyWorkerLifecycle = (input) => {
     data: {
       ...entry.data,
       state: terminalCancel ? "cancelling" : input.state,
-      session: input.session
+      session: input.session,
+      report: entry.data.report ?? input.report ?? null
     }
   };
   const shouldClear = input.state === "stopped" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
   const shouldUncertain = input.state === "unknown" && workspace.data.writer !== null && workspace.data.writer.owner.taskId === task.data.id && workspace.data.writer.owner.workerId === input.workerId;
-  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && !shouldClear && !shouldUncertain)
+  if (entry.data.state === nextEntry.data.state && sameValue(entry.data.session, input.session) && sameValue(entry.data.report, nextEntry.data.report) && !shouldClear && !shouldUncertain)
     return success(task.data.revision, workspace.data.revision, entry);
   const changed = input.store.mutateTaskAndWorkspace({
     taskId: task.data.id,
@@ -13758,14 +14071,30 @@ class WorkitCore {
         const listed = this.store.listTasks();
         if (!listed.ok)
           return listed;
-        const summaries = [];
-        for (const task of listed.data) {
-          const summary = this.summary(task);
-          if (!summary.ok)
-            return summary;
-          summaries.push(summary.data);
-        }
-        return success(null, null, summaries);
+        const status = input.status ?? "open";
+        const limit = input.limit ?? 20;
+        const selected = listed.data.filter((task) => status === "all" ? true : status === "closed" ? task.status === "closed" : task.status !== "closed").sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).slice(0, limit);
+        if (selected.length === 0)
+          return success(null, null, []);
+        const workspace = this.store.readWorkspace();
+        if (!workspace.ok)
+          return workspace;
+        if (!workspace.data)
+          return failure("not_found", "workspace not found");
+        const tasks = selected.map((task) => ({
+          id: task.id,
+          revision: task.revision,
+          workspaceRevision: workspace.data.revision,
+          createdAt: task.createdAt,
+          updatedAt: task.updatedAt,
+          runtime: task.runtime ?? null,
+          objective: task.intent.data.objective,
+          status: task.status,
+          closure: task.closure,
+          progress: task.progress,
+          writer: task.status === "closed" ? null : workspace.data.writer
+        }));
+        return success(null, null, tasks);
       }
       case "inspect": {
         const task = this.store.readTask(input.taskId);
@@ -13774,7 +14103,7 @@ class WorkitCore {
         const helper = this.helperTaskGuard(task.data, true);
         if (!helper.ok)
           return helper;
-        if (input.view === "summary")
+        if ((input.view ?? "summary") === "summary")
           return this.summary(task.data);
         return this.view(task.data);
       }
@@ -14118,7 +14447,7 @@ class WorkitCore {
       const evaluations = evaluateEvidence(task.data, current.data);
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
-        return findingVerificationPasses(finding.data.candidateId, {
+        return entry.recordedAt >= finding.recordedAt && findingVerificationPasses(finding.data.candidateId, {
           kind: entry.data.kind,
           candidateId: entry.data.candidateId,
           status: evaluation?.status ?? "missing"
@@ -14198,7 +14527,18 @@ class WorkitCore {
       if (task.data.status !== "active")
         return failure("invalid_transition", "paused or closed tasks cannot assign workers");
       if (!bindingCovers(task.data.intent.data.scope, input.assignment.scope))
-        return failure("permission_denied", "worker assignment is outside task scope");
+        return failure("permission_denied", "worker assignment is outside task scope", {
+          fields: [
+            {
+              path: "assignment.scope",
+              reason: `paths ${JSON.stringify(input.assignment.scope.paths)} must be contained by lead paths ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            },
+            {
+              path: "task.intent.scope",
+              reason: `lead paths are ${JSON.stringify(task.data.intent.data.scope.paths)}`
+            }
+          ]
+        });
       if (input.assignment.decisionIds.some((id) => !task.data.decisions.some((entry) => entry.id === id)))
         return failure("invalid_input", "worker assignment references an unknown decision");
       if (input.assignment.requirementIds.some((id) => !task.data.policy?.requirements.some((requirement) => requirement.id === id)))
@@ -14405,7 +14745,15 @@ class WorkitCore {
             ...item,
             recordedAt: mutation.now,
             provenance: attested.data,
-            data: { ...item.data, state: "dispatching" }
+            data: {
+              ...item.data,
+              state: "dispatching",
+              coordinator: {
+                kind: "host",
+                host: this.context.caller.host,
+                handle: this.context.caller.actor
+              }
+            }
           } : item)
         });
       }
@@ -14481,6 +14829,7 @@ class WorkitCore {
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         state: "stopped",
         session: null,
+        report: null,
         provenance: attested.data,
         owner: this.authorityOwner,
         store: this.store,
@@ -14788,10 +15137,12 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       id: task.id,
       revision: task.revision,
@@ -14805,7 +15156,7 @@ class WorkitCore {
       progress: task.progress,
       policy: task.policy,
       requirements,
-      writer: workspace.data.writer
+      writer: evaluationWorkspace.writer
     });
   }
   view(task) {
@@ -14814,13 +15165,15 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    const current = captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
     if (!current.ok)
       return current;
-    const requirements = evaluateRequirements(task, workspace.data, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
     return success(task.revision, workspace.data.revision, {
       task,
-      workspace: workspace.data,
+      workspace: evaluationWorkspace,
       capabilities: this.context.capabilities,
       requirements,
       evidence: evaluateEvidence(task, current.data)
@@ -14911,8 +15264,6 @@ class WorkitCore {
       return helper;
     if (status === "paused" && task.data.status !== "active" || status === "active" && task.data.status !== "paused")
       return failure("invalid_transition", `cannot transition ${task.data.status} to ${status}`);
-    if (status === "active" && input.authorityRefs.length === 0)
-      return failure("permission_denied", "resuming a task requires authority references");
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
@@ -14942,7 +15293,7 @@ class WorkitCore {
         return failure("needs_input", "imported task requires fresh destination evidence");
       if (current.data.blockers.some((blocker) => blocker.dependentAction === "resume" || blocker.reason === "worker state requires reconciliation"))
         return failure("recovery_required", "imported task requires resume reconciliation");
-      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs, this.context))
+      if (!validResumeApproval(task.data, workspace.data, input.authorityRefs ?? [], this.context))
         return failure("permission_denied", "imported resume requires native destination approval");
       resumeCandidate = current.data.candidate;
     }
@@ -15072,7 +15423,7 @@ class WorkitCore {
       task: (value, context) => success(context.revision, null, {
         ...value,
         status: "closed",
-        candidates: value.candidates.some((item) => item.id === withCandidate.id) ? value.candidates : [...value.candidates, withCandidate],
+        candidates: taskForView.candidates,
         closure: {
           outcome: closure.data.outcome,
           at: context.now,
@@ -15151,6 +15502,22 @@ function run2(root, executable, args, env = {}) {
 }
 
 // packages/workit-core/src/core/skill-manifests.ts
+var WORKIT_METHOD_SKILLS = [
+  "workit-challenge",
+  "workit-behavioral-tdd",
+  "workit-review",
+  "workit-plan",
+  "workit-implement",
+  "workit-debug",
+  "workit-handoff",
+  "workit-babysit",
+  "workit-blast-radius",
+  "workit-deslop",
+  "workit-diagram",
+  "workit-mockup",
+  "workit-green-run",
+  "workit-steer"
+];
 var WORKIT_SKILL_ALIASES = {
   "wk-challenge": "workit-challenge",
   "wk-babysit": "workit-babysit",
@@ -15407,27 +15774,54 @@ OpenCode Workit decisions use the native question header "Workit decision: <purp
   return cached2;
 };
 
-// packages/workit-opencode/src/stale-sources.ts
-import { existsSync as existsSync7 } from "node:fs";
+// packages/workit-opencode/src/shared/assets.ts
+import { existsSync as existsSync7, realpathSync as realpathSync7 } from "node:fs";
+import path13 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+var moduleDir = () => {
+  try {
+    return realpathSync7(path13.dirname(fileURLToPath2(import.meta.url)));
+  } catch {
+    return path13.dirname(fileURLToPath2(import.meta.url));
+  }
+};
+var packageRoot2 = () => {
+  const dir = moduleDir();
+  for (const candidate of [
+    path13.resolve(dir, ".."),
+    path13.resolve(dir, "..", ".."),
+    path13.resolve(dir, "..", "..", "..")
+  ]) {
+    if (existsSync7(path13.join(candidate, "package.json")))
+      return candidate;
+  }
+  return path13.resolve(dir, "..");
+};
+var assetsRoot = () => path13.join(packageRoot2(), "assets");
+
+// packages/workit-opencode/src/stale-sources.ts
+import { existsSync as existsSync8, readdirSync as readdirSync5 } from "node:fs";
+import path14 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+var typescriptFiles = (directory) => {
+  if (!existsSync8(directory))
+    return [];
+  return readdirSync5(directory, { withFileTypes: true }).flatMap((entry) => {
+    const file = path14.join(directory, entry.name);
+    return entry.isDirectory() ? typescriptFiles(file) : entry.isFile() && file.endsWith(".ts") ? [file] : [];
+  });
+};
 var pluginSourceFiles = [
-  fileURLToPath2(import.meta.url),
-  fileURLToPath2(new URL("./plugin.ts", import.meta.url)),
-  fileURLToPath2(new URL("./tools/workit.ts", import.meta.url)),
-  ...[
-    "task-contract.ts",
-    "task-engine.ts",
-    "task-evaluation.ts",
-    "task-store.ts",
-    "workers.ts",
-    "authority.ts",
-    "methods.ts"
-  ].map((file) => fileURLToPath2(new URL(`../../workit-core/src/core/${file}`, import.meta.url)))
-].filter((file) => existsSync7(file));
+  ...new Set([
+    fileURLToPath3(import.meta.url),
+    ...typescriptFiles(path14.join(packageRoot2(), "src")),
+    path14.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
+    ...typescriptFiles(path14.join(packageRoot2(), "..", "workit-core", "src", "core"))
+  ])
+].filter((file) => existsSync8(file)).sort();
 
 // packages/workit-opencode/src/tools/repo.ts
-import path22 from "node:path";
-import { realpathSync as realpathSync8 } from "node:fs";
+import { realpathSync as realpathSync9 } from "node:fs";
 
 // node_modules/@opencode-ai/plugin/node_modules/zod/v4/classic/external.js
 var exports_external = {};
@@ -27751,7 +28145,7 @@ function tool(input) {
 tool.schema = exports_external;
 // packages/workit-core/src/core/changelog.ts
 import fs8 from "node:fs";
-import path13 from "node:path";
+import path15 from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 
 // packages/workit-core/src/core/scripts.ts
@@ -27948,7 +28342,7 @@ function applyChangelog(target, entries, normalizeOnly) {
   const rendered = renderChangelog(source.text, entries, normalizeOnly);
   if ("error" in rendered)
     return { error: rendered.error };
-  fs8.mkdirSync(path13.dirname(target), { recursive: true });
+  fs8.mkdirSync(path15.dirname(target), { recursive: true });
   fs8.writeFileSync(target, rendered.text, "utf8");
   return { ...rendered.result, path: target };
 }
@@ -27983,14 +28377,14 @@ function renderChangelog(source, entries, normalizeOnly) {
 var changelogTarget = (workspaceRoot, changelogPath) => {
   try {
     const cwd = fs8.realpathSync(resolveWorkspaceRoot(workspaceRoot));
-    const target = path13.resolve(cwd, changelogPath || "CHANGELOG.md");
-    if (target !== cwd && !target.startsWith(cwd + path13.sep))
+    const target = path15.resolve(cwd, changelogPath || "CHANGELOG.md");
+    if (target !== cwd && !target.startsWith(cwd + path15.sep))
       return { error: "changelog path must be inside workspace_root" };
     let ancestor = target;
     while (!fs8.existsSync(ancestor))
-      ancestor = path13.dirname(ancestor);
+      ancestor = path15.dirname(ancestor);
     const canonicalAncestor = fs8.realpathSync(ancestor);
-    if (canonicalAncestor !== cwd && !canonicalAncestor.startsWith(cwd + path13.sep))
+    if (canonicalAncestor !== cwd && !canonicalAncestor.startsWith(cwd + path15.sep))
       return { error: "changelog path must be inside workspace_root" };
     return { cwd, target: fs8.existsSync(target) ? fs8.realpathSync(target) : target };
   } catch {
@@ -28138,121 +28532,9 @@ function parseVerifyOutput(stdout) {
   return { passed, failed, skipped, commands };
 }
 
-// packages/workit-core/src/core/gitignore.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "node:fs";
-import path14 from "node:path";
-var GITIGNORE_ENTRIES = [
-  "# workit: SDD working state (never commit)",
-  "docs/*/sdd/",
-  "",
-  "# OS / editor cruft",
-  ".DS_Store",
-  "Thumbs.db",
-  "*.swp",
-  ".idea/",
-  ".vscode/",
-  ".env",
-  "node_modules/",
-  "dist/",
-  "*.log",
-  ".cache/"
-];
-var ensureProjectGitignore = (workspaceRoot, confirmed) => {
-  if (!confirmed)
-    return { ok: false, error: "confirmed: true required" };
-  const file = path14.join(workspaceRoot, ".gitignore");
-  const existing = existsSync8(file) ? readFileSync8(file, "utf8") : "";
-  const existingLines = new Set(existing.split(`
-`).map((l) => l.trim()).filter(Boolean));
-  const added = [];
-  const append = [];
-  for (const entry of GITIGNORE_ENTRIES) {
-    if (entry.trim() === "" || existingLines.has(entry.trim()))
-      continue;
-    append.push(entry);
-    added.push(entry);
-  }
-  if (append.length) {
-    const separator = existing && !existing.endsWith(`
-`) ? `
-` : "";
-    writeFileSync4(file, existing + separator + (existing ? `
-` : "") + append.join(`
-`) + `
-`, "utf8");
-  } else if (!existsSync8(file)) {
-    writeFileSync4(file, "", "utf8");
-  }
-  return { ok: true, path: file, added };
-};
-
-// packages/workit-core/src/core/hygiene.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
-import path15 from "node:path";
-var repoRoot = assetRoot();
-var templatesDir = () => path15.join(repoRoot, "templates", "hygiene");
-var packageJson = (root) => {
-  if (!existsSync9(path15.join(root, "package.json")))
-    return null;
-  try {
-    return JSON.parse(readFileSync9(path15.join(root, "package.json"), "utf8"));
-  } catch {
-    return null;
-  }
-};
-var isOpenSource = (root) => {
-  if (existsSync9(path15.join(root, "LICENSE")))
-    return true;
-  const pkg = packageJson(root);
-  if (pkg && !pkg.private)
-    return true;
-  return path15.basename(root) === "workflow-toolkit";
-};
-var licenseHolder = (root) => {
-  const pkg = packageJson(root);
-  if (pkg) {
-    const author = pkg.author;
-    if (typeof author === "string" && author.trim())
-      return author.trim();
-    if (author && typeof author === "object") {
-      const name = author.name;
-      if (typeof name === "string" && name.trim())
-        return name.trim();
-    }
-  }
-  return "";
-};
-var planHygieneFiles = (root, opts = {}) => {
-  const openSource = opts.includeOpenSource ?? isOpenSource(root);
-  const files = ["CHANGELOG.md", "README.md", ".editorconfig", ".gitattributes"];
-  if (openSource)
-    files.push("LICENSE", "CONTRIBUTING.md");
-  const planned = [];
-  for (const file of files) {
-    if (existsSync9(path15.join(root, file)))
-      continue;
-    const tpl = path15.join(templatesDir(), file);
-    if (!existsSync9(tpl))
-      continue;
-    const content = readFileSync9(tpl, "utf8").replace(/<PROJECT>/g, path15.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
-    planned.push({ path: path15.join(root, file), content });
-  }
-  return planned;
-};
-var ensureHygieneFiles = (root, opts) => {
-  if (!opts.confirmed)
-    return { ok: false, error: "confirmed: true required" };
-  const created = [];
-  for (const planned of planHygieneFiles(root, opts)) {
-    writeFileSync5(planned.path, planned.content, "utf8");
-    created.push(path15.basename(planned.path));
-  }
-  return { ok: true, created };
-};
-
 // packages/workit-core/src/core/repo-context.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync10, readdirSync as readdirSync5 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8, readdirSync as readdirSync6 } from "node:fs";
 import path16 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
@@ -28287,7 +28569,7 @@ var runGit = (cwd, args) => {
     exitCode: result.status ?? 1
   };
 };
-var repoRoot2 = (cwd) => {
+var repoRoot = (cwd) => {
   const r = runGit(cwd, ["rev-parse", "--show-toplevel"]);
   return r.exitCode === 0 && r.stdout ? r.stdout : cwd;
 };
@@ -28324,7 +28606,7 @@ function resolvePrBranchContext(cwd) {
     if (branch === "unknown") {
       return {
         ok: false,
-        error: `not in a git repository at ${repoRoot2(cwd)} — open the target repository as the OpenCode session directory`
+        error: `not in a git repository at ${repoRoot(cwd)} — open the target repository as the OpenCode session directory`
       };
     }
     return {
@@ -28367,7 +28649,7 @@ var printSection = (title) => `
 `;
 var probeCaseInsensitive = (dir, wanted) => {
   try {
-    for (const entry of readdirSync5(dir)) {
+    for (const entry of readdirSync6(dir)) {
       if (entry.toLowerCase() === wanted.toLowerCase())
         return entry;
     }
@@ -28419,10 +28701,10 @@ var diffStatForRange = (cwd, range) => {
 };
 var packageScripts = (cwd, keys) => {
   const pkgPath = path16.join(cwd, "package.json");
-  if (!existsSync10(pkgPath))
+  if (!existsSync9(pkgPath))
     return [];
   try {
-    const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
     return keys.filter((k) => pkg.scripts && typeof pkg.scripts[k] === "string").map((k) => `${k}: ${pkg.scripts?.[k]}`);
   } catch {
     return [];
@@ -28436,7 +28718,7 @@ var documentationFiles = (cwd) => {
       return;
     let entries;
     try {
-      entries = readdirSync5(dir, { withFileTypes: true });
+      entries = readdirSync6(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -28454,15 +28736,15 @@ var documentationFiles = (cwd) => {
   return matches.sort().slice(0, 200);
 };
 var readTrimmed = (file, maxLines) => {
-  if (!existsSync10(file))
+  if (!existsSync9(file))
     return "";
-  const lines = readFileSync10(file, "utf8").split(`
+  const lines = readFileSync8(file, "utf8").split(`
 `);
   return lines.slice(0, maxLines).join(`
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path16.resolve(repoRoot2(root));
+  const cwd = path16.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -28530,7 +28812,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync10(path16.join(cwd, "package.json"))) {
+  if (existsSync9(path16.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -28539,7 +28821,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync10(path16.join(cwd, "Cargo.toml")) || existsSync10(path16.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync9(path16.join(cwd, "Cargo.toml")) || existsSync9(path16.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -28572,7 +28854,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the native workit_changelog_apply tool only (not hand-edits under Unreleased).
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path16.resolve(repoRoot2(root));
+  const cwd = path16.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -28591,7 +28873,7 @@ function changelogContext(root, range) {
 `;
   stdout += printSection("Existing CHANGELOG.md");
   const changelogPath = path16.join(cwd, "CHANGELOG.md");
-  if (existsSync10(changelogPath)) {
+  if (existsSync9(changelogPath)) {
     stdout += readTrimmed(changelogPath, 260) + `
 `;
   } else {
@@ -28610,7 +28892,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path16.resolve(repoRoot2(root));
+  const cwd = path16.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -28633,7 +28915,7 @@ function docsRefreshContext(root, range) {
 `;
   stdout += printSection("README Preview");
   const readme = path16.join(cwd, "README.md");
-  if (existsSync10(readme)) {
+  if (existsSync9(readme)) {
     stdout += readTrimmed(readme, 220) + `
 `;
   } else {
@@ -28642,9 +28924,9 @@ function docsRefreshContext(root, range) {
   }
   stdout += printSection("Package Scripts");
   const pkgPath = path16.join(cwd, "package.json");
-  if (existsSync10(pkgPath)) {
+  if (existsSync9(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
       stdout += JSON.stringify({ name: pkg.name, version: pkg.version, scripts: pkg.scripts }, null, 2) + `
 `;
     } catch {}
@@ -28655,7 +28937,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path16.resolve(repoRoot2(root));
+  const cwd = path16.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -28693,7 +28975,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync10(path16.join(cwd, rel)))
+    if (existsSync9(path16.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -28722,7 +29004,7 @@ function releaseNotesContext(root, rangeOrTag) {
 
 // packages/workit-core/src/core/verify-project.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync11, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, statSync as statSync2 } from "node:fs";
 import path17 from "node:path";
 var commandOnPath = (name) => {
   const dirs = (process.env.PATH ?? "").split(path17.delimiter);
@@ -28747,33 +29029,33 @@ var commandOnPath = (name) => {
 };
 var hasScript = (cwd, name) => {
   const pkgPath = path17.join(cwd, "package.json");
-  if (!existsSync11(pkgPath))
+  if (!existsSync10(pkgPath))
     return false;
   try {
-    const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
     return Boolean(pkg.scripts && typeof pkg.scripts[name] === "string");
   } catch {
     return false;
   }
 };
 var packageRunner = (cwd) => {
-  if (existsSync11(path17.join(cwd, "pnpm-lock.yaml")))
+  if (existsSync10(path17.join(cwd, "pnpm-lock.yaml")))
     return "pnpm";
   const pkgPath = path17.join(cwd, "package.json");
-  if (existsSync11(pkgPath)) {
+  if (existsSync10(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
       if (typeof pkg.packageManager === "string" && pkg.packageManager.startsWith("pnpm")) {
         return "pnpm";
       }
     } catch {}
   }
-  if (existsSync11(path17.join(cwd, "yarn.lock")))
+  if (existsSync10(path17.join(cwd, "yarn.lock")))
     return "yarn";
   return "npm";
 };
 function runVerifyProject(root, dryRun = false) {
-  const cwd = repoRoot2(root);
+  const cwd = repoRoot(root);
   let passed = 0;
   let failed = 0;
   let skipped = 0;
@@ -28829,7 +29111,7 @@ root: ${cwd}
   lines.push(`dry_run: ${String(dryRun)}
 `);
   const pkgPath = path17.join(cwd, "package.json");
-  if (existsSync11(pkgPath)) {
+  if (existsSync10(pkgPath)) {
     const runner = packageRunner(cwd);
     for (const script of ["lint", "format:check", "test", "build"]) {
       if (hasScript(cwd, script)) {
@@ -28844,7 +29126,7 @@ root: ${cwd}
   } else {
     skipCheck("javascript", "package.json not found");
   }
-  const cargoManifest = existsSync11(path17.join(cwd, "Cargo.toml")) ? "Cargo.toml" : existsSync11(path17.join(cwd, "src-tauri/Cargo.toml")) ? "src-tauri/Cargo.toml" : "";
+  const cargoManifest = existsSync10(path17.join(cwd, "Cargo.toml")) ? "Cargo.toml" : existsSync10(path17.join(cwd, "src-tauri/Cargo.toml")) ? "src-tauri/Cargo.toml" : "";
   if (cargoManifest) {
     runCheck("cargo fmt", "cargo", ["fmt", "--manifest-path", cargoManifest, "--", "--check"]);
     runCheck("cargo clippy", "cargo", [
@@ -28860,7 +29142,7 @@ root: ${cwd}
   } else {
     skipCheck("rust", "Cargo.toml not found");
   }
-  if (existsSync11(path17.join(cwd, "pyproject.toml")) || existsSync11(path17.join(cwd, "pytest.ini")) || existsSync11(path17.join(cwd, "tests"))) {
+  if (existsSync10(path17.join(cwd, "pyproject.toml")) || existsSync10(path17.join(cwd, "pytest.ini")) || existsSync10(path17.join(cwd, "tests"))) {
     if (commandOnPath("pytest"))
       runCheck("pytest", "pytest", []);
     else
@@ -28882,8 +29164,8 @@ root: ${cwd}
     lines.push(`status: skipped (dry run)
 `);
     skipped += 1;
-  } else if (existsSync11(changelogPath)) {
-    if (/## \[Unreleased\]/i.test(readFileSync11(changelogPath, "utf8"))) {
+  } else if (existsSync10(changelogPath)) {
+    if (/## \[Unreleased\]/i.test(readFileSync9(changelogPath, "utf8"))) {
       lines.push(`status: pass
 `);
       passed += 1;
@@ -28997,12 +29279,12 @@ function whichOnPath(tool) {
   return null;
 }
 var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
-function repoRoot3(cwd) {
+function repoRoot2(cwd) {
   const result = spawnSync6("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8" });
   return result.status === 0 ? (result.stdout ?? "").trim() : cwd;
 }
 function prCreate(env, cwd) {
-  const root = cwd ? repoRoot3(cwd) : process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
+  const root = cwd ? repoRoot2(cwd) : process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
   const policy = resolveBranchPolicyFor(root);
   const cfg = vcsConfig("load", root);
   if (!cfg.ok)
@@ -29195,7 +29477,7 @@ function prCreate(env, cwd) {
   };
 }
 function mergePr(cwd, opts) {
-  const root = repoRoot3(cwd);
+  const root = repoRoot2(cwd);
   const cfg = vcsConfig("load", root);
   if (!cfg.ok)
     return { error: cfg.error ?? "vcs config missing" };
@@ -29244,14 +29526,14 @@ function mergePr(cwd, opts) {
 
 // packages/workit-core/src/core/init.ts
 import fs11 from "node:fs";
-import path21 from "node:path";
+import path23 from "node:path";
 import { spawnSync as spawnSync8 } from "node:child_process";
 
 // packages/workit-core/src/core/safe-write.ts
-import { writeFileSync as writeFileSync6 } from "node:fs";
+import { writeFileSync as writeFileSync4 } from "node:fs";
 function writeFileExclusive(file, content, mode) {
   try {
-    writeFileSync6(file, content, { encoding: "utf8", flag: "wx", mode });
+    writeFileSync4(file, content, { encoding: "utf8", flag: "wx", mode });
     return "created";
   } catch (err) {
     if (err.code === "EEXIST")
@@ -29264,19 +29546,19 @@ function writeFileExclusive(file, content, mode) {
 import {
   copyFileSync as copyFileSync2,
   cpSync as cpSync2,
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync5,
   mkdtempSync,
   readFileSync as readFileSync12,
-  readdirSync as readdirSync6,
-  realpathSync as realpathSync7,
+  readdirSync as readdirSync7,
+  realpathSync as realpathSync8,
   renameSync as renameSync2,
   rmSync,
   statSync as statSync3,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import path19 from "node:path";
+import path21 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 // packages/workit-core/src/core/branch-policy.ts
@@ -29339,6 +29621,118 @@ var detectBranchPolicy = (workspaceRoot) => {
   };
 };
 
+// packages/workit-core/src/core/gitignore.ts
+import { existsSync as existsSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
+import path19 from "node:path";
+var GITIGNORE_ENTRIES = [
+  "# workit: SDD working state (never commit)",
+  "docs/*/sdd/",
+  "",
+  "# OS / editor cruft",
+  ".DS_Store",
+  "Thumbs.db",
+  "*.swp",
+  ".idea/",
+  ".vscode/",
+  ".env",
+  "node_modules/",
+  "dist/",
+  "*.log",
+  ".cache/"
+];
+var ensureProjectGitignore = (workspaceRoot, confirmed) => {
+  if (!confirmed)
+    return { ok: false, error: "confirmed: true required" };
+  const file = path19.join(workspaceRoot, ".gitignore");
+  const existing = existsSync11(file) ? readFileSync10(file, "utf8") : "";
+  const existingLines = new Set(existing.split(`
+`).map((l) => l.trim()).filter(Boolean));
+  const added = [];
+  const append = [];
+  for (const entry of GITIGNORE_ENTRIES) {
+    if (entry.trim() === "" || existingLines.has(entry.trim()))
+      continue;
+    append.push(entry);
+    added.push(entry);
+  }
+  if (append.length) {
+    const separator = existing && !existing.endsWith(`
+`) ? `
+` : "";
+    writeFileSync5(file, existing + separator + (existing ? `
+` : "") + append.join(`
+`) + `
+`, "utf8");
+  } else if (!existsSync11(file)) {
+    writeFileSync5(file, "", "utf8");
+  }
+  return { ok: true, path: file, added };
+};
+
+// packages/workit-core/src/core/hygiene.ts
+import { existsSync as existsSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "node:fs";
+import path20 from "node:path";
+var repoRoot3 = assetRoot();
+var templatesDir = () => path20.join(repoRoot3, "templates", "hygiene");
+var packageJson = (root) => {
+  if (!existsSync12(path20.join(root, "package.json")))
+    return null;
+  try {
+    return JSON.parse(readFileSync11(path20.join(root, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+};
+var isOpenSource = (root) => {
+  if (existsSync12(path20.join(root, "LICENSE")))
+    return true;
+  const pkg = packageJson(root);
+  if (pkg && !pkg.private)
+    return true;
+  return path20.basename(root) === "workflow-toolkit";
+};
+var licenseHolder = (root) => {
+  const pkg = packageJson(root);
+  if (pkg) {
+    const author = pkg.author;
+    if (typeof author === "string" && author.trim())
+      return author.trim();
+    if (author && typeof author === "object") {
+      const name = author.name;
+      if (typeof name === "string" && name.trim())
+        return name.trim();
+    }
+  }
+  return "";
+};
+var planHygieneFiles = (root, opts = {}) => {
+  const openSource = opts.includeOpenSource ?? isOpenSource(root);
+  const files = ["CHANGELOG.md", "README.md", ".editorconfig", ".gitattributes"];
+  if (openSource)
+    files.push("LICENSE", "CONTRIBUTING.md");
+  const planned = [];
+  for (const file of files) {
+    if (existsSync12(path20.join(root, file)))
+      continue;
+    const tpl = path20.join(templatesDir(), file);
+    if (!existsSync12(tpl))
+      continue;
+    const content = readFileSync11(tpl, "utf8").replace(/<PROJECT>/g, path20.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
+    planned.push({ path: path20.join(root, file), content });
+  }
+  return planned;
+};
+var ensureHygieneFiles = (root, opts) => {
+  if (!opts.confirmed)
+    return { ok: false, error: "confirmed: true required" };
+  const created = [];
+  for (const planned of planHygieneFiles(root, opts)) {
+    writeFileSync6(planned.path, planned.content, "utf8");
+    created.push(path20.basename(planned.path));
+  }
+  return { ok: true, created };
+};
+
 // packages/workit-core/src/core/registration.ts
 var CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest";
 var CURSOR_HOOK_RUN_COMMAND = `npx -y --prefer-online --min-release-age=0 --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-hook`;
@@ -29380,12 +29774,12 @@ var VCS_OVERRIDES = [
 var SETUP_OVERRIDES = [...YT_OVERRIDES, ...VCS_OVERRIDES];
 function applyWorkspaceBranchPolicy(opts) {
   const { workspace_root, env = process.env } = opts;
-  const dir = path19.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const dir = path21.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
   const { status, path: wsPath, entries } = readWorkspacesResult(dir);
   if (status === "malformed")
     return { ok: false, error: `malformed workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
-  const name = String(env.WORKFLOW_BP_NAME ?? path19.basename(workspace_root));
+  const name = String(env.WORKFLOW_BP_NAME ?? path21.basename(workspace_root));
   const integration = env.WORKFLOW_BP_INTEGRATION ?? detection.integration;
   const policy = {
     preset: detection.preset,
@@ -29410,7 +29804,7 @@ function applyWorkspaceBranchPolicy(opts) {
     };
   }
   const next = existing ? entries.map((w, i) => i === idx ? { ...w, branchPolicy: policy } : w) : [...entries, { name, glob, branchPolicy: policy }];
-  mkdirSync5(path19.dirname(wsPath), { recursive: true });
+  mkdirSync5(path21.dirname(wsPath), { recursive: true });
   writeFileSync7(wsPath, JSON.stringify({ workspaces: next }, null, 2) + `
 `, "utf8");
   return {
@@ -29424,7 +29818,7 @@ function applyWorkspaceBranchPolicy(opts) {
 
 // packages/workit-core/src/core/youtrack.ts
 import fs10 from "node:fs";
-import path20 from "node:path";
+import path22 from "node:path";
 
 // packages/workit-core/src/core/templates.ts
 var repoRoot4 = assetRoot();
@@ -29432,8 +29826,8 @@ var repoRoot4 = assetRoot();
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
 var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path20.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path20.join(resolveConfigDir(), "youtrack.json");
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path22.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path22.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
@@ -29477,7 +29871,7 @@ function youTrackConfigLoad() {
   }
   const cfgPath = loaded.path;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path20.isAbsolute(tokenFile) ? path20.resolve(tokenFile) : path20.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path22.isAbsolute(tokenFile) ? path22.resolve(tokenFile) : path22.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs10.existsSync(tokenPath)) {
     return { error: "missing youtrack.token" };
   }
@@ -29491,8 +29885,8 @@ function youTrackConfigLoad() {
   const redacted = { ...loaded.config };
   delete redacted.tokenFile;
   redacted.tokenPresent = true;
-  redacted.configPath = path20.resolve(cfgPath);
-  redacted.tokenPath = path20.resolve(tokenPath);
+  redacted.configPath = path22.resolve(cfgPath);
+  redacted.tokenPath = path22.resolve(tokenPath);
   return { data: redacted };
 }
 function tzParts(date, tz) {
@@ -29605,7 +29999,7 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path20.isAbsolute(tokenFile) ? path20.resolve(tokenFile) : path20.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path22.isAbsolute(tokenFile) ? path22.resolve(tokenFile) : path22.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs10.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
@@ -29760,7 +30154,7 @@ function youTrackTokenCreateUrl() {
   const desc = String(defaults.description ?? "OpenCode workit — /wk-issue-update and /wk-meetings");
   const scopes = Array.isArray(defaults.scopes) ? defaults.scopes : ["YouTrack"];
   const base = String(config.baseUrl ?? "https://enghouseamg.youtrack.cloud").replace(/\/+$/, "");
-  const tokenFile = String(config.tokenFile ?? path20.join(path20.dirname(loaded.path), "youtrack.token"));
+  const tokenFile = String(config.tokenFile ?? path22.join(path22.dirname(loaded.path), "youtrack.token"));
   const tab = String(defaults.profileTab ?? "account-security");
   const createUrl = `${base}/users/me?${new URLSearchParams({ tab })}`;
   const docsUrl = "https://www.jetbrains.com/help/youtrack/cloud/manage-permanent-token.html";
@@ -29769,7 +30163,7 @@ function youTrackTokenCreateUrl() {
       tokenName: name,
       tokenDescription: desc,
       scopes,
-      tokenFile: path20.resolve(tokenFile),
+      tokenFile: path22.resolve(tokenFile),
       createUrl,
       docsUrl,
       prefillSupported: false,
@@ -30087,12 +30481,12 @@ var resolvePath = (p) => {
   try {
     return fs11.realpathSync(p);
   } catch {
-    return path21.resolve(p);
+    return path23.resolve(p);
   }
 };
 function initStatusData(configDirPath = configDir()) {
-  const ytJson = path21.join(configDirPath, "youtrack.json");
-  const vcsJson = path21.join(configDirPath, "vcs.json");
+  const ytJson = path23.join(configDirPath, "youtrack.json");
+  const vcsJson = path23.join(configDirPath, "vcs.json");
   const items = [];
   let youtrackConfig = null;
   let youtrackTokenCreate = null;
@@ -30115,8 +30509,8 @@ function initStatusData(configDirPath = configDir()) {
         });
       }
     }
-    const expanded = tokenFile ? path21.resolve(tokenFile) : null;
-    const resolvedTokenFile = expanded && fs11.existsSync(expanded) ? resolvePath(expanded) : expanded ? path21.isAbsolute(expanded) ? expanded : path21.resolve(configDirPath, expanded) : null;
+    const expanded = tokenFile ? path23.resolve(tokenFile) : null;
+    const resolvedTokenFile = expanded && fs11.existsSync(expanded) ? resolvePath(expanded) : expanded ? path23.isAbsolute(expanded) ? expanded : path23.resolve(configDirPath, expanded) : null;
     youtrackConfig = {
       config_edit_path: resolvePath(ytJson),
       baseUrl: base,
@@ -30163,11 +30557,11 @@ function initStatusData(configDirPath = configDir()) {
     id: "youtrack_json",
     label: "YouTrack config",
     ok: fs11.existsSync(ytJson) && youtrackConfig !== null && !("error" in youtrackConfig),
-    path: fs11.existsSync(ytJson) ? resolvePath(ytJson) : path21.resolve(ytJson),
+    path: fs11.existsSync(ytJson) ? resolvePath(ytJson) : path23.resolve(ytJson),
     config_edit_path: resolvePath(ytJson),
     fix: "workit_init_apply action=youtrack_scaffold"
   });
-  const ytTokenPath = youtrackConfig?.tokenFile ?? path21.join(configDirPath, "youtrack.token");
+  const ytTokenPath = youtrackConfig?.tokenFile ?? path23.join(configDirPath, "youtrack.token");
   const tokenText = fs11.existsSync(ytTokenPath) ? fs11.readFileSync(ytTokenPath, "utf8").trim() : "";
   const placeholder = fs11.existsSync(ytTokenPath) && isPlaceholder(tokenText);
   const tokenOk = fs11.existsSync(ytTokenPath) && modeOk(ytTokenPath) && Boolean(tokenText) && !isPlaceholder(tokenText);
@@ -30175,8 +30569,8 @@ function initStatusData(configDirPath = configDir()) {
     id: "youtrack_token",
     label: "YouTrack API token (mode 600, not placeholder)",
     ok: tokenOk,
-    path: fs11.existsSync(ytTokenPath) ? resolvePath(ytTokenPath) : path21.resolve(ytTokenPath),
-    token_edit_path: fs11.existsSync(ytTokenPath) ? resolvePath(ytTokenPath) : path21.resolve(ytTokenPath),
+    path: fs11.existsSync(ytTokenPath) ? resolvePath(ytTokenPath) : path23.resolve(ytTokenPath),
+    token_edit_path: fs11.existsSync(ytTokenPath) ? resolvePath(ytTokenPath) : path23.resolve(ytTokenPath),
     placeholder,
     fix: `Open ${resolvePath(ytTokenPath)} — replace ${TOKEN_PLACEHOLDER3} with your permanent token, save, then /wk-status`
   };
@@ -30202,7 +30596,7 @@ function initStatusData(configDirPath = configDir()) {
     const provider = typeof rawProvider === "string" && rawProvider.trim() ? rawProvider.toLowerCase() : null;
     const tokenFiles = {};
     for (const k of ["gitlab", "github"]) {
-      tokenFiles[k] = String(vcsParsed[k]?.tokenFile ?? path21.join(configDirPath, `${k}.token`));
+      tokenFiles[k] = String(vcsParsed[k]?.tokenFile ?? path23.join(configDirPath, `${k}.token`));
     }
     vcsCfg = {
       config_edit_path: resolvePath(vcsJson),
@@ -30227,14 +30621,14 @@ function initStatusData(configDirPath = configDir()) {
     id: "vcs_json",
     label: "VCS config (GitLab / GitHub)",
     ok: fs11.existsSync(vcsJson) && vcsCfg !== null && !("error" in vcsCfg),
-    path: fs11.existsSync(vcsJson) ? resolvePath(vcsJson) : path21.resolve(vcsJson),
+    path: fs11.existsSync(vcsJson) ? resolvePath(vcsJson) : path23.resolve(vcsJson),
     config_edit_path: resolvePath(vcsJson),
     fix: "workit_init_apply action=vcs_scaffold"
   });
   const provActive = vcsCfg && !("error" in vcsCfg) ? vcsCfg.provider : null;
   const tokenItem = (tid, label, rawPath, providerKey) => {
-    const t = path21.isAbsolute(rawPath) ? rawPath : path21.resolve(configDirPath, rawPath);
-    const abs = fs11.existsSync(t) ? resolvePath(t) : path21.resolve(t);
+    const t = path23.isAbsolute(rawPath) ? rawPath : path23.resolve(configDirPath, rawPath);
+    const abs = fs11.existsSync(t) ? resolvePath(t) : path23.resolve(t);
     const text = fs11.existsSync(t) ? fs11.readFileSync(t, "utf8").trim() : "";
     const ph = isPlaceholder(text);
     const ok = fs11.existsSync(t) && modeOk(t) && Boolean(text) && !ph;
@@ -30265,7 +30659,7 @@ function initStatusData(configDirPath = configDir()) {
   };
   const vcsTokenFiles = {};
   for (const k of ["gitlab", "github"]) {
-    vcsTokenFiles[k] = String(vcsParsed?.[k]?.tokenFile ?? path21.join(configDirPath, `${k}.token`));
+    vcsTokenFiles[k] = String(vcsParsed?.[k]?.tokenFile ?? path23.join(configDirPath, `${k}.token`));
   }
   items.push(tokenItem("gitlab_token", "GitLab token (mode 600, not placeholder)", vcsTokenFiles.gitlab, "gitlab"));
   items.push(tokenItem("github_token", "GitHub token (mode 600, not placeholder)", vcsTokenFiles.github, "github"));
@@ -30322,7 +30716,7 @@ async function toolkitStatusData(configDirPath = configDir()) {
 }
 var youtrackJsonContent = (dir) => ({
   baseUrl: process.env.WORKFLOW_YT_BASE_URL ?? "https://enghouseamg.youtrack.cloud",
-  tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path21.join(dir, "youtrack.token"),
+  tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path23.join(dir, "youtrack.token"),
   timezone: process.env.WORKFLOW_YT_TIMEZONE ?? "America/Santiago",
   locale: "es-CL",
   defaultMention: process.env.WORKFLOW_YT_MENTION ?? "Alejandra.Flores",
@@ -30361,11 +30755,11 @@ var vcsJsonContent = (dir, cwd) => {
     gitlab: {
       host: process.env.WORKFLOW_GITLAB_HOST ?? "gitlab.com",
       apiUrl: process.env.WORKFLOW_GITLAB_API_URL ?? "https://gitlab.com/api/v4",
-      tokenFile: path21.join(dir, "gitlab.token")
+      tokenFile: path23.join(dir, "gitlab.token")
     },
     github: {
       host: process.env.WORKFLOW_GITHUB_HOST ?? "github.com",
-      tokenFile: path21.join(dir, "github.token")
+      tokenFile: path23.join(dir, "github.token")
     },
     pr: { squashOnMerge: true, removeSourceBranch: true, pushBranch: true, confirmSkip: true },
     tokenDefaults: {
@@ -30382,16 +30776,16 @@ function initApplyData(action, env = process.env) {
   fs11.mkdirSync(dir, { recursive: true });
   switch (action) {
     case "youtrack_json": {
-      const out = path21.join(dir, "youtrack.json");
+      const out = path23.join(dir, "youtrack.json");
       fs11.writeFileSync(out, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       return { action, ok: true, path: out };
     }
     case "youtrack_token_placeholder": {
-      const p = path21.join(dir, "youtrack.token");
+      const p = path23.join(dir, "youtrack.token");
       const preserved = writeFileExclusive(p, TOKEN_PLACEHOLDER3 + `
 `, 384) === "preserved";
-      const abs = path21.resolve(p);
+      const abs = path23.resolve(p);
       return {
         action,
         ok: true,
@@ -30403,14 +30797,14 @@ function initApplyData(action, env = process.env) {
       };
     }
     case "youtrack_scaffold": {
-      const jsonOut = path21.join(dir, "youtrack.json");
-      const tokenOut = path21.join(dir, "youtrack.token");
+      const jsonOut = path23.join(dir, "youtrack.json");
+      const tokenOut = path23.join(dir, "youtrack.token");
       fs11.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       const preserved = writeFileExclusive(tokenOut, TOKEN_PLACEHOLDER3 + `
 `, 384) === "preserved";
-      const configPath = path21.resolve(jsonOut);
-      const tokenPath = path21.resolve(tokenOut);
+      const configPath = path23.resolve(jsonOut);
+      const tokenPath = path23.resolve(tokenOut);
       const prev = process.env.WORKFLOW_YOUTRACK_CONFIG;
       process.env.WORKFLOW_YOUTRACK_CONFIG = configPath;
       let tokenCreate = {};
@@ -30464,19 +30858,19 @@ function initApplyData(action, env = process.env) {
       }
     }
     case "vcs_scaffold": {
-      const jsonOut = path21.join(dir, "vcs.json");
+      const jsonOut = path23.join(dir, "vcs.json");
       fs11.writeFileSync(jsonOut, JSON.stringify(vcsJsonContent(dir), null, 2) + `
 `, "utf8");
-      const glPath = path21.join(dir, "gitlab.token");
-      const ghPath = path21.join(dir, "github.token");
+      const glPath = path23.join(dir, "gitlab.token");
+      const ghPath = path23.join(dir, "github.token");
       const preservedTokens = [];
       for (const p of [glPath, ghPath]) {
         if (writeFileExclusive(p, TOKEN_PLACEHOLDER3 + `
 `, 384) === "preserved") {
-          preservedTokens.push(path21.resolve(p));
+          preservedTokens.push(path23.resolve(p));
         }
       }
-      const configPath = path21.resolve(jsonOut);
+      const configPath = path23.resolve(jsonOut);
       const prev = process.env.WORKFLOW_VCS_CONFIG;
       process.env.WORKFLOW_VCS_CONFIG = configPath;
       try {
@@ -30485,14 +30879,14 @@ function initApplyData(action, env = process.env) {
         const provider = typeof rawProvider === "string" && rawProvider.trim() ? rawProvider : null;
         const tokenUrls = vcsTokenCreateUrls();
         const active = tokenUrls.active ?? {};
-        const activePath = provider === "gitlab" ? path21.resolve(glPath) : provider === "github" ? path21.resolve(ghPath) : null;
+        const activePath = provider === "gitlab" ? path23.resolve(glPath) : provider === "github" ? path23.resolve(ghPath) : null;
         return {
           action,
           ok: true,
           vcs_json: configPath,
           config_edit_path: configPath,
-          gitlab_token: path21.resolve(glPath),
-          github_token: path21.resolve(ghPath),
+          gitlab_token: path23.resolve(glPath),
+          github_token: path23.resolve(ghPath),
           token_edit_path: activePath,
           token_create_url: active.createUrl,
           token_create_urls: tokenUrls,
@@ -30547,6 +30941,109 @@ var normalizeLegacyResult = (value) => {
   return ok(data);
 };
 
+// packages/workit-opencode/src/shared/init-apply.ts
+import path24 from "node:path";
+
+// packages/workit-opencode/src/shared/repo-result.ts
+var output = (value) => JSON.stringify(value, null, 2);
+var diagnostics = ({ stdout, stderr, exitCode }) => ({
+  stdout,
+  stderr,
+  exitCode
+});
+var requireConfirmed = (confirmed) => {
+  if (confirmed === true)
+    return null;
+  return output(fail("confirmed: true required"));
+};
+function scriptResult(result, parse) {
+  if (result.exitCode !== 0) {
+    return fail(result.stderr.trim() || result.stdout.trim() || "workflow script failed", diagnostics(result));
+  }
+  try {
+    return ok({
+      ...parse(result.stdout),
+      exitCode: 0,
+      ...result.stderr ? { stderr: result.stderr } : {}
+    });
+  } catch (error) {
+    return fail(error instanceof Error ? error.message : "workflow output parse failed", diagnostics(result));
+  }
+}
+var legacyScriptResult = (result) => {
+  let parsed = null;
+  try {
+    parsed = JSON.parse(result.stdout.trim());
+  } catch {}
+  if (result.exitCode !== 0 || parsed?.error || parsed?.ok === false) {
+    const error = parsed?.error ? String(parsed.error) : parsed?.ok === false ? "legacy operation reported failure" : result.stderr.trim() || result.stdout.trim() || "workflow script failed";
+    return fail(error, diagnostics(result));
+  }
+  if (!parsed)
+    return fail("workflow output parse failed", diagnostics(result));
+  const { ok: _legacyOk, ...data } = parsed;
+  return ok({ ...data, exitCode: 0, ...result.stderr ? { stderr: result.stderr } : {} });
+};
+
+// packages/workit-opencode/src/shared/init-apply.ts
+var initApplyRuntime = {
+  initApply: (root, action, env) => {
+    const out = initApply({ action, confirmed: true, env });
+    return {
+      exitCode: out.error ? 1 : 0,
+      stdout: JSON.stringify(out.data ?? out),
+      stderr: "",
+      cwd: root
+    };
+  }
+};
+var executeInitApply = (args, directory, runtime) => {
+  const rejected = requireConfirmed(args.confirmed);
+  if (rejected)
+    return rejected;
+  const action = args.action;
+  if (action === "hygiene") {
+    const result = ensureHygieneFiles(directory, {
+      confirmed: args.confirmed,
+      includeOpenSource: args.include_open_source
+    });
+    return output(result.ok ? ok(result) : fail(result.error));
+  }
+  if (action === "gitignore") {
+    const result = ensureProjectGitignore(directory, args.confirmed);
+    return output(result.ok ? ok(result) : fail(result.error));
+  }
+  if (action === "config") {
+    const LOCALE_RE = /^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/;
+    if (args.locale !== undefined && !LOCALE_RE.test(args.locale)) {
+      return output(fail(`invalid locale: ${JSON.stringify(args.locale)} — expected BCP-47 like en or es-CL`));
+    }
+    const current = readConfig();
+    const next = mergeConfigValues({
+      locale: args.locale,
+      localeOptions: args.locale_options,
+      timezone: args.timezone,
+      preset: args.branch_policy_preset,
+      allowed: args.branch_policy_allowed,
+      protectedNames: args.branch_policy_protected
+    }, current);
+    writeConfig(next);
+    return output(ok({ action: "config", path: path24.join(configDir(), "config.json"), ...next }));
+  }
+  const env = Object.fromEntries(Object.entries({
+    WORKFLOW_YT_BASE_URL: args.base_url,
+    WORKFLOW_YT_MENTION: args.default_mention,
+    WORKFLOW_YT_MEETING_ISSUE: args.meeting_issue,
+    WORKFLOW_VCS_PROVIDER: args.vcs_provider,
+    WORKFLOW_VCS_TARGET_BRANCH: args.vcs_target_branch,
+    WORKFLOW_WORKSPACE_ROOT: directory,
+    WORKFLOW_BP_NAME: args.name,
+    WORKFLOW_BP_DEVELOP: args.develop_branch,
+    WORKFLOW_BP_INTEGRATION: args.integration
+  }).filter((entry) => entry[1] !== undefined));
+  return output(legacyScriptResult(runtime.initApply(directory, action, env)));
+};
+
 // packages/workit-opencode/src/tools/repo.ts
 var defaultRuntime = {
   git: (root, args) => run2(root, "git", args),
@@ -30564,15 +31061,7 @@ var defaultRuntime = {
       cwd: root
     };
   },
-  initApply: (root, action, env) => {
-    const out = initApply({ action, confirmed: true, env });
-    return {
-      exitCode: out.error ? 1 : 0,
-      stdout: JSON.stringify(out.data ?? out),
-      stderr: "",
-      cwd: root
-    };
-  },
+  ...initApplyRuntime,
   initStatus: (root) => ({
     exitCode: 0,
     stdout: JSON.stringify(initStatusData()),
@@ -30586,36 +31075,7 @@ var defaultRuntime = {
     cwd: root
   })
 };
-var output = (value) => JSON.stringify(value, null, 2);
-var diagnostics = ({ stdout, stderr, exitCode }) => ({ stdout, stderr, exitCode });
-var requireConfirmed = (confirmed) => confirmed === true ? null : output(fail("confirmed: true required"));
-function scriptResult(result, parse) {
-  if (result.exitCode !== 0) {
-    return fail(result.stderr.trim() || result.stdout.trim() || "workflow script failed", diagnostics(result));
-  }
-  try {
-    return ok({
-      ...parse(result.stdout),
-      exitCode: 0,
-      ...result.stderr ? { stderr: result.stderr } : {}
-    });
-  } catch (error) {
-    return fail(error instanceof Error ? error.message : "workflow output parse failed", diagnostics(result));
-  }
-}
 var json2 = (stdout) => JSON.parse(stdout.trim());
-var legacyScriptResult = (result) => {
-  let parsed = null;
-  try {
-    parsed = json2(result.stdout);
-  } catch {}
-  if (result.exitCode !== 0 || parsed?.error || parsed?.ok === false)
-    return fail(parsed?.error ? String(parsed.error) : parsed?.ok === false ? "legacy operation reported failure" : result.stderr.trim() || result.stdout.trim() || "workflow script failed", diagnostics(result));
-  if (!parsed)
-    return fail("workflow output parse failed", diagnostics(result));
-  const { ok: _legacyOk, ...data } = parsed;
-  return ok({ ...data, exitCode: 0, ...result.stderr ? { stderr: result.stderr } : {} });
-};
 var optionalJson = (value) => {
   if (!value?.trim())
     return null;
@@ -30770,7 +31230,7 @@ function createRepoTools(runtime = defaultRuntime) {
           entries,
           path: changelogPath,
           normalize_only,
-          workspace_root: realpathSync8(context.directory)
+          workspace_root: realpathSync9(context.directory)
         })));
       }
     }),
@@ -30891,77 +31351,11 @@ function createRepoTools(runtime = defaultRuntime) {
         branch_policy_protected: tool.schema.array(tool.schema.string()).optional(),
         include_open_source: tool.schema.boolean().optional()
       },
-      execute: async ({
-        confirmed,
-        action,
-        base_url,
-        default_mention,
-        meeting_issue,
-        vcs_provider,
-        vcs_target_branch,
-        name,
-        develop_branch,
-        integration,
-        locale,
-        locale_options,
-        timezone,
-        branch_policy_preset,
-        branch_policy_allowed,
-        branch_policy_protected,
-        include_open_source
-      }, context) => {
-        const rejected = requireConfirmed(confirmed);
-        if (rejected)
-          return rejected;
-        if (action === "hygiene") {
-          const result = ensureHygieneFiles(context.directory, {
-            confirmed,
-            includeOpenSource: include_open_source
-          });
-          return output(result.ok ? ok(result) : fail(result.error));
-        }
-        if (action === "gitignore") {
-          const result = ensureProjectGitignore(context.directory, confirmed);
-          return output(result.ok ? ok(result) : fail(result.error));
-        }
-        if (action === "config") {
-          const LOCALE_RE = /^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/;
-          if (locale !== undefined && !LOCALE_RE.test(locale)) {
-            return output(fail(`invalid locale: ${JSON.stringify(locale)} — expected BCP-47 like en or es-CL`));
-          }
-          const current = readConfig();
-          const next = mergeConfigValues({
-            locale,
-            localeOptions: locale_options,
-            timezone,
-            preset: branch_policy_preset,
-            allowed: branch_policy_allowed,
-            protectedNames: branch_policy_protected
-          }, current);
-          writeConfig(next);
-          return output(ok({ action: "config", path: path22.join(configDir(), "config.json"), ...next }));
-        }
-        const env = Object.fromEntries(Object.entries({
-          WORKFLOW_YT_BASE_URL: base_url,
-          WORKFLOW_YT_MENTION: default_mention,
-          WORKFLOW_YT_MEETING_ISSUE: meeting_issue,
-          WORKFLOW_VCS_PROVIDER: vcs_provider,
-          WORKFLOW_VCS_TARGET_BRANCH: vcs_target_branch,
-          WORKFLOW_WORKSPACE_ROOT: context.directory,
-          WORKFLOW_BP_NAME: name,
-          WORKFLOW_BP_DEVELOP: develop_branch,
-          WORKFLOW_BP_INTEGRATION: integration
-        }).filter((entry) => entry[1] !== undefined));
-        return output(legacyScriptResult(runtime.initApply(context.directory, action, env)));
-      }
+      execute: async (args, context) => executeInitApply(args, context.directory, runtime)
     })
   };
 }
 
-// packages/workit-opencode/src/tools/workit.ts
-import { realpathSync as realpathSync9 } from "node:fs";
-import path24 from "node:path";
-
 // packages/workit-core/src/core/tracker-issues.ts
 import fs12 from "node:fs";
 import { spawnSync as spawnSync9 } from "node:child_process";
@@ -31233,7 +31627,7 @@ async function logTimeUpdate(input, operation = defaultOperations) {
 
 // packages/workit-core/src/core/external-action-effects.ts
 import fs13 from "node:fs";
-import path23 from "node:path";
+import path25 from "node:path";
 
 // packages/workit-core/src/core/commit-flavors.ts
 var CONVENTIONAL_RE = /^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?(!)?: .+/;
@@ -31423,7 +31817,7 @@ var readExternalContext = async (root, payload) => {
     }
   }
 };
-var localAction = (operation) => operation === "git.branch_setup" || operation === "git.commit" || operation === "git.push" || operation === "hosting.pull_request" || operation === "changelog.apply";
+var localAction = (operation) => operation === "git.branch_setup" || operation === "git.commit" || operation === "git.push" || operation === "hosting.pull_request" || operation === "hosting.merge" || operation === "changelog.apply";
 var assertLocalExternalActionWriter = (root, caller, paths = ["."]) => {
   const store = new TaskStore(root);
   const listed = store.listTasks();
@@ -31434,7 +31828,7 @@ var assertLocalExternalActionWriter = (root, caller, paths = ["."]) => {
     return workspace;
   if (!workspace.data)
     return failure("not_found", "workspace not found");
-  const candidates = listed.data.filter((task) => task.status === "active" && task.workspaceId === workspace.data.id && task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === caller.host && task.intent.provenance.session.handle === caller.actor);
+  const candidates = listed.data.filter((task) => currentWriterOwnsTask(task, workspace.data, caller));
   if (candidates.length !== 1)
     return failure("permission_denied", "local external action requires exactly one active task");
   const allowed = assertProductWriteAllowed({
@@ -31444,7 +31838,7 @@ var assertLocalExternalActionWriter = (root, caller, paths = ["."]) => {
     paths,
     store
   });
-  return allowed.ok ? success(null, null, null) : allowed;
+  return allowed;
 };
 var safePath = (root, value) => {
   try {
@@ -31456,13 +31850,20 @@ var safePath = (root, value) => {
 var branchCreationBaseline = (root, target, base) => {
   const exists = gitValue(root, ["rev-parse", "--verify", "--quiet", `refs/heads/${target}`]) !== null;
   if (exists)
-    return { base_branch: base, target_exists: true, remote_base: null };
+    return {
+      base_branch: base,
+      target_exists: true,
+      remote_base: null,
+      target_head: gitValue(root, ["rev-parse", `refs/heads/${target}`])
+    };
   const remote = run4(root, ["ls-remote", "origin", `refs/heads/${base}`]);
   const sha = remote.exitCode === 0 ? remote.stdout.trim().split(/\s+/)[0] : "";
+  const remoteBase = /^[0-9a-f]{40}$/.test(sha ?? "") ? sha : null;
   return {
     base_branch: base,
     target_exists: false,
-    remote_base: /^[0-9a-f]{40}$/.test(sha ?? "") ? sha : null
+    remote_base: remoteBase,
+    target_head: remoteBase
   };
 };
 var shortSha = (value) => typeof value === "string" && value ? value.slice(0, 8) : "unknown";
@@ -31573,7 +31974,7 @@ var actionProposalQuestion = (request, descriptorPayload) => {
 var approvedResolvedExternalAction = (content) => {
   try {
     const value = JSON.parse(content);
-    if (value.operation !== "hosting.pull_request" && value.operation !== "hosting.merge" && value.operation !== "changelog.apply" && value.operation !== "youtrack.update" && value.operation !== "youtrack.time" && value.operation !== "youtrack.meeting")
+    if (value.operation !== "git.branch_setup" && value.operation !== "git.commit" && value.operation !== "git.push" && value.operation !== "hosting.pull_request" && value.operation !== "hosting.merge" && value.operation !== "changelog.apply" && value.operation !== "youtrack.update" && value.operation !== "youtrack.time" && value.operation !== "youtrack.meeting")
       return failure("invalid_input", "approved action is not a reconciliable external action");
     if (!value.payload || typeof value.payload !== "object")
       return failure("invalid_input", "approved action payload is incomplete");
@@ -31584,18 +31985,24 @@ var approvedResolvedExternalAction = (content) => {
     if (!request.ok || !resolved || typeof resolved !== "object")
       return failure("invalid_input", "approved hosting target is incomplete");
     const target = resolved;
+    if (value.operation === "git.commit" && (typeof target.head !== "string" || typeof target.staged !== "string" || typeof payload.message !== "string"))
+      return failure("invalid_input", "approved Git commit target is incomplete");
+    if (value.operation === "git.push" && (typeof target.branch !== "string" || typeof target.commit !== "string" || typeof target.remote !== "string"))
+      return failure("invalid_input", "approved Git push target is incomplete");
+    if (value.operation === "git.branch_setup" && (typeof target.head !== "string" || (payload.action === "reapply_stash" ? typeof target.stash_commit !== "string" : typeof payload.target_branch !== "string" || typeof target.target_head !== "string")))
+      return failure("invalid_input", "approved Git branch target is incomplete");
     if (value.operation === "hosting.pull_request" && (typeof target.marker !== "string" || typeof target.source_branch !== "string" || typeof target.source_commit !== "string" || typeof target.remote !== "string" || typeof payload.target_branch !== "string"))
       return failure("invalid_input", "approved hosting target is incomplete");
     if (value.operation === "hosting.merge" && (typeof target.marker !== "string" || typeof target.source_branch !== "string" || typeof target.source_commit !== "string" || typeof target.remote !== "string" || typeof payload.target_branch !== "string"))
       return failure("invalid_input", "approved hosting target is incomplete");
     if (value.operation === "changelog.apply" && (typeof target.target !== "string" || typeof target.beforeDigest !== "string" || typeof target.beforeExists !== "boolean" || typeof target.afterDigest !== "string"))
       return failure("invalid_input", "approved changelog target is incomplete");
-    if (value.operation !== "hosting.pull_request" && value.operation !== "changelog.apply" && (typeof target.marker !== "string" || typeof target.baseUrl !== "string" || typeof target.issueId !== "string" || !Array.isArray(target.steps)))
+    if (value.operation !== "git.branch_setup" && value.operation !== "git.commit" && value.operation !== "git.push" && value.operation !== "hosting.pull_request" && value.operation !== "hosting.merge" && value.operation !== "changelog.apply" && (typeof target.marker !== "string" || typeof target.baseUrl !== "string" || typeof target.issueId !== "string" || !Array.isArray(target.steps)))
       return failure("invalid_input", "approved YouTrack target is incomplete");
     return success(null, null, {
       request: request.data,
       descriptorPayload: value.payload,
-      marker: String(target.marker)
+      ...typeof target.marker === "string" ? { marker: target.marker } : {}
     });
   } catch {
     return failure("invalid_input", "approved action descriptor is invalid");
@@ -31621,12 +32028,13 @@ var unknownHostingEvidence = (operation) => failure("external_outcome_unknown",
   outcome: "unknown"
 });
 var readHostingAction = async (root, resolved, actionRef) => {
-  if (resolved.request.operation !== "hosting.pull_request" || !resolved.marker)
-    return unknownHostingEvidence("hosting.pull_request");
+  const operation = resolved.request.operation;
+  if (operation !== "hosting.pull_request" && operation !== "hosting.merge" || !resolved.marker)
+    return unknownHostingEvidence(operation);
   try {
     const cfg = vcsConfig("load", root);
     if (!cfg.ok || !cfg.tokenPath || !cfg.provider || cfg.provider !== "github" && cfg.provider !== "gitlab")
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const remote = pushRemote(root);
     const repo = remote ? remoteRepo(remote) : null;
     const approved = resolved.descriptorPayload;
@@ -31645,7 +32053,7 @@ var readHostingAction = async (root, resolved, actionRef) => {
       }
     })();
     if (!repo || typeof branch !== "string" || typeof target !== "string" || typeof sourceCommit !== "string" || typeof approvedRemote !== "string" || !currentIdentity || currentIdentity !== approvedIdentity || repo !== remoteRepo(approvedRemote) || remoteProvider2(approvedRemote) !== null && remoteProvider2(approvedRemote) !== cfg.provider || remoteParts(approvedRemote)?.host !== apiHost)
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const token = fs13.readFileSync(cfg.tokenPath, "utf8").trim();
     const headers = { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json" };
     const url = cfg.provider === "github" ? `https://api.github.com/repos/${repo}/pulls?state=all&head=${encodeURIComponent(`${repo.split("/")[0]}:${branch}`)}&base=${encodeURIComponent(target)}&per_page=100&page=1` : `${cfg.gitlab?.apiUrl ?? "https://gitlab.com/api/v4"}/projects/${encodeURIComponent(repo)}/merge_requests?state=all&source_branch=${encodeURIComponent(branch)}&target_branch=${encodeURIComponent(target)}&per_page=100&page=1`;
@@ -31653,14 +32061,14 @@ var readHostingAction = async (root, resolved, actionRef) => {
       headers: cfg.provider === "gitlab" ? { "PRIVATE-TOKEN": token } : headers
     });
     if (!response.ok)
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const values = await response.json();
     if (!Array.isArray(values) || values.length >= 100)
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const records = [];
     for (const item of values) {
       if (!item || typeof item !== "object" || Array.isArray(item))
-        return unknownHostingEvidence("hosting.pull_request");
+        return unknownHostingEvidence(operation);
       const record = item;
       const body = record.body ?? record.description;
       const base = record.base;
@@ -31672,7 +32080,7 @@ var readHostingAction = async (root, resolved, actionRef) => {
       const shaValue = cfg.provider === "github" && githubShape ? head.sha : record.sha;
       const idValue = record.number ?? record.iid ?? record.id;
       if (body !== undefined && body !== null && typeof body !== "string" || (cfg.provider === "github" ? !githubShape : !gitlabShape) || typeof targetValue !== "string" || typeof sourceValue !== "string" || typeof shaValue !== "string" || typeof idValue !== "string" && typeof idValue !== "number")
-        return unknownHostingEvidence("hosting.pull_request");
+        return unknownHostingEvidence(operation);
       records.push(record);
     }
     const matches = records.filter((item) => {
@@ -31682,15 +32090,23 @@ var readHostingAction = async (root, resolved, actionRef) => {
       const itemTarget = cfg.provider === "github" ? base?.ref : item.target_branch;
       const itemSource = cfg.provider === "github" ? head?.ref : item.source_branch;
       const itemSha = cfg.provider === "github" ? head?.sha : item.sha;
-      return body.includes(resolved.marker) && itemTarget === target && itemSource === branch && itemSha === sourceCommit;
+      const merged = cfg.provider === "github" ? typeof item.merged_at === "string" : item.state === "merged" || typeof item.merged_at === "string";
+      return (operation === "hosting.merge" ? merged : body.includes(resolved.marker)) && itemTarget === target && itemSource === branch && itemSha === sourceCommit;
     });
+    if (operation === "hosting.merge" && records.some((item) => {
+      const base = item.base;
+      const head = item.head;
+      return (cfg.provider === "github" ? base?.ref : item.target_branch) === target && (cfg.provider === "github" ? head?.ref : item.source_branch) === branch && (cfg.provider === "github" ? typeof item.merged_at !== "string" : item.state !== "merged" && typeof item.merged_at !== "string");
+    }))
+      return unknownHostingEvidence(operation);
     if (matches.length !== 1)
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const item = matches[0];
     const id = item.number ?? item.iid ?? item.id;
     if (typeof id !== "string" && typeof id !== "number")
-      return unknownHostingEvidence("hosting.pull_request");
+      return unknownHostingEvidence(operation);
     const evidenceDigest = sha256({
+      operation,
       provider: cfg.provider,
       id,
       marker: resolved.marker,
@@ -31711,7 +32127,7 @@ var readHostingAction = async (root, resolved, actionRef) => {
       data: { provider: cfg.provider, id }
     });
   } catch {
-    return unknownHostingEvidence("hosting.pull_request");
+    return unknownHostingEvidence(operation);
   }
 };
 var appendMarker = (text, marker) => `${text}${text ? `
@@ -31801,7 +32217,70 @@ var readYouTrackAction = async (root, resolved, actionRef) => {
     return unknownHostingEvidence(operation);
   }
 };
-var readExternalAction = async (root, resolved, actionRef) => resolved.request.operation === "hosting.pull_request" ? readHostingAction(root, resolved, actionRef) : readYouTrackAction(root, resolved, actionRef);
+var readLocalAction = async (root, resolved, actionRef) => {
+  const operation = resolved.request.operation;
+  const target = resolved.descriptorPayload.resolved;
+  if (!target)
+    return unknownHostingEvidence(operation);
+  let observed = null;
+  if (operation === "git.commit") {
+    const commit = gitValue(root, ["rev-parse", "HEAD"]);
+    const parent = commit ? gitValue(root, ["rev-parse", `${commit}^`]) : null;
+    const message = commit ? gitValue(root, ["show", "-s", "--format=%B", commit]) : null;
+    const diff = commit && parent ? gitRaw(root, ["diff", "--raw", "-z", "--no-ext-diff", "--no-textconv", parent, commit]) : null;
+    if (commit && parent === target.head && message === resolved.request.payload.message && diff !== null && sha256(diff) === target.staged)
+      observed = { commit, parent, message, staged: target.staged };
+  } else if (operation === "git.push") {
+    const branch = target.branch;
+    const commit = target.commit;
+    const approvedRemote = target.remote;
+    const currentRemote = pushRemote(root);
+    const currentIdentity = currentRemote ? credentialFreeRemote(currentRemote) : null;
+    if (typeof branch === "string" && typeof commit === "string" && typeof approvedRemote === "string" && currentIdentity === approvedRemote) {
+      const remote = run4(root, ["ls-remote", currentRemote, `refs/heads/${branch}`]);
+      const remoteCommit = remote.exitCode === 0 ? remote.stdout.trim().split(/\s+/)[0] : null;
+      if (remoteCommit === commit)
+        observed = { branch, commit, remote: approvedRemote };
+    }
+  } else if (operation === "git.branch_setup") {
+    const targetBranch = resolved.request.payload.target_branch;
+    const sdd = resolved.request.payload.sdd_dir;
+    if (resolved.request.payload.action === "reapply_stash" && typeof sdd === "string") {
+      try {
+        const manifest = JSON.parse(fs13.readFileSync(path25.join(sdd, "manifest.json"), "utf8"));
+        const stashes = gitRaw(root, ["stash", "list", "--format=%H"]);
+        if (typeof target.stash_commit === "string" && manifest.stash_ref === undefined && stashes !== null && !stashes.split(`
+`).includes(target.stash_commit))
+          observed = { stash_commit: target.stash_commit };
+      } catch {}
+    } else if (typeof targetBranch === "string" && typeof sdd === "string" && gitValue(root, ["branch", "--show-current"]) === targetBranch && typeof target.target_head === "string" && gitValue(root, ["rev-parse", "HEAD"]) === target.target_head) {
+      try {
+        const manifest = JSON.parse(fs13.readFileSync(path25.join(sdd, "manifest.json"), "utf8"));
+        if (manifest.branch === targetBranch)
+          observed = { branch: targetBranch };
+      } catch {}
+    }
+  } else if (operation === "changelog.apply") {
+    const afterDigest = target.afterDigest;
+    const preview = changelogApplyPreview({ ...resolved.request.payload, workspace_root: root });
+    if (!preview.error && typeof afterDigest === "string" && preview.beforeDigest === afterDigest)
+      observed = { target: target.target, afterDigest };
+  }
+  if (!observed)
+    return unknownHostingEvidence(operation);
+  const evidenceDigest = sha256({ operation, observed });
+  return success(null, null, {
+    outcome: "succeeded",
+    evidenceDigest,
+    observation: {
+      kind: "provider_read",
+      actionRef,
+      outcome: "succeeded",
+      evidenceDigest
+    }
+  });
+};
+var readExternalAction = async (root, resolved, actionRef) => resolved.request.operation === "git.branch_setup" || resolved.request.operation === "git.commit" || resolved.request.operation === "git.push" || resolved.request.operation === "changelog.apply" ? readLocalAction(root, resolved, actionRef) : resolved.request.operation === "hosting.pull_request" || resolved.request.operation === "hosting.merge" ? readHostingAction(root, resolved, actionRef) : readYouTrackAction(root, resolved, actionRef);
 var youTrackBase = () => {
   try {
     const config = JSON.parse(fs13.readFileSync(youTrackConfigPath(), "utf8"));
@@ -31859,6 +32338,16 @@ var resolveExternalActionRequest = (root, request, preservedDateMs) => {
           return failure("storage_error", "current Git commit could not be resolved");
         const dirty = Boolean((gitRaw(root, ["status", "--short"]) ?? "").trim());
         const creation = action === "reapply_stash" || !target_branch ? { base_branch: policy.defaultTargetBranch } : branchCreationBaseline(root, target_branch, policy.defaultTargetBranch);
+        let stashTarget;
+        if (action === "reapply_stash") {
+          try {
+            const manifest = JSON.parse(fs13.readFileSync(path25.join(sdd_dir, "manifest.json"), "utf8"));
+            const stash_ref = typeof manifest.stash_ref === "string" ? manifest.stash_ref : "";
+            const stash_commit = stash_ref ? gitValue(root, ["rev-parse", stash_ref]) : null;
+            if (stash_ref && stash_commit)
+              stashTarget = { stash_ref, stash_commit };
+          } catch {}
+        }
         const normalized = {
           operation: request.operation,
           payload: {
@@ -31873,7 +32362,7 @@ var resolveExternalActionRequest = (root, request, preservedDateMs) => {
           request: normalized,
           descriptorPayload: {
             ...normalized.payload,
-            resolved: { head, dirty, ...creation }
+            resolved: { head, dirty, ...creation, ...stashTarget }
           }
         });
       }
@@ -32025,7 +32514,7 @@ var resolveExternalActionRequest = (root, request, preservedDateMs) => {
             outcome: "not_started",
             fields: [{ path: "source_branch", reason: "protected branch" }]
           });
-        const source_commit = gitValue(root, ["rev-parse", "HEAD"]);
+        const source_commit = source_branch ? gitValue(root, ["rev-parse", "--verify", `refs/heads/${source_branch}`]) : null;
         const remote = pushRemote(root);
         const identity = remote ? credentialFreeRemote(remote) : null;
         if (!source_branch || !source_commit || !identity || remoteProvider2(identity) !== null && remoteProvider2(identity) !== String(vcsConfig("load", root).provider).toLowerCase())
@@ -32060,7 +32549,7 @@ var resolveExternalActionRequest = (root, request, preservedDateMs) => {
         if (preview.error)
           return failure("invalid_input", preview.error);
         const target = String(preview.path);
-        const relative = path23.relative(fs13.realpathSync(root), target).replaceAll(path23.sep, "/") || "CHANGELOG.md";
+        const relative = path25.relative(fs13.realpathSync(root), target).replaceAll(path25.sep, "/") || "CHANGELOG.md";
         const normalized = {
           operation: request.operation,
           payload: {
@@ -32313,27 +32802,34 @@ var executeResolvedExternalAction = async (resolved, root, step, caller) => {
   const workText = fresh.data.descriptorPayload.resolved?.workText;
   const beforeDigest = typeof resolvedDetails.resolved?.beforeDigest === "string" ? resolvedDetails.resolved.beforeDigest : undefined;
   const beforeExists = typeof resolvedDetails.resolved?.beforeExists === "boolean" ? resolvedDetails.resolved.beforeExists : undefined;
-  return executeConcreteExternalAction(fresh.data.request, root, fresh.data.marker, resolvedDate, step, typeof workText === "string" ? workText : undefined, caller, beforeDigest, beforeExists);
+  const result = await executeConcreteExternalAction(fresh.data.request, root, fresh.data.marker, resolvedDate, step, typeof workText === "string" ? workText : undefined, caller, beforeDigest, beforeExists);
+  if (!result.ok && result.code === "external_outcome_unknown" && caller) {
+    const observed = await readLocalAction(root, fresh.data, {
+      kind: "host",
+      host: caller.host,
+      handle: `local-recovery:${fresh.data.request.operation}`
+    });
+    if (observed.ok)
+      return success(null, null, { recovered: true });
+  }
+  return result;
 };
 
-// packages/workit-opencode/src/tools/workit.ts
-var sessionParent = (session) => {
-  if (typeof session !== "object" || session === null)
-    return null;
-  if (!Object.prototype.hasOwnProperty.call(session, "parentID"))
-    return;
-  const parentID = session.parentID;
-  return typeof parentID === "string" && parentID.length > 0 ? parentID : null;
-};
-var rejectedDescription = "Reject this decision";
-var isSelfAuthorizingActionContent = (content) => {
+// packages/workit-opencode/src/shared/session.ts
+import { realpathSync as realpathSync10 } from "node:fs";
+import path26 from "node:path";
+var sameWorkspace = (expected, observed) => {
+  if (typeof observed !== "string" || !observed)
+    return false;
   try {
-    const value = JSON.parse(content);
-    return typeof value.operation === "string" && value.operation.length > 0;
+    return realpathSync10(expected) === realpathSync10(observed);
   } catch {
-    return /^[a-z][a-z_]*\.[a-z_]+$/.test(content);
+    return path26.resolve(expected) === path26.resolve(observed);
   }
 };
+
+// packages/workit-opencode/src/shared/decision-content.ts
+var rejectedDescription = "Reject this decision";
 var decisionContent = (purpose, question, approvedContent) => ({
   header: `Workit decision: ${purpose}`,
   question,
@@ -32342,6 +32838,24 @@ var decisionContent = (purpose, question, approvedContent) => ({
     { label: "rejected", description: rejectedDescription }
   ]
 });
+var isSelfAuthorizingActionContent = (content) => {
+  try {
+    const value = JSON.parse(content);
+    return typeof value.operation === "string" && value.operation.length > 0;
+  } catch {
+    return /^[a-z][a-z_]*\.[a-z_]+$/.test(content);
+  }
+};
+
+// packages/workit-opencode/src/tools/workit.ts
+var sessionParent = (session) => {
+  if (typeof session !== "object" || session === null)
+    return null;
+  if (!Object.prototype.hasOwnProperty.call(session, "parentID"))
+    return;
+  const parentID = session.parentID;
+  return typeof parentID === "string" && parentID.length > 0 ? parentID : null;
+};
 var decisionOptions = (options) => Array.isArray(options) && options.length === 2 && options.every((option) => typeof option === "object" && option !== null && typeof option.label === "string" && typeof option.description === "string" && Object.keys(option).length === 2 && Object.keys(option).every((key) => key === "label" || key === "description")) ? options : null;
 var normalizeReceiptLabel = (label) => label.trim().replace(/(?:\s*[([]\s*[^()[\]]*\s*[)\]]\s*)+$/u, "").trim().toLowerCase();
 var purposeForQuestion = (question) => {
@@ -32356,6 +32870,7 @@ var purposeForQuestion = (question) => {
 class NativeReceiptStore {
   #receipts = new Map;
   #observations = new WeakSet;
+  #reservations = new WeakMap;
   #pending = new Map;
   #now;
   constructor(options = {}) {
@@ -32428,7 +32943,7 @@ class NativeReceiptStore {
     const args = input.args;
     this.mint(input.sessionID, input.callID, args?.questions, answers);
   }
-  consume(sessionID, purpose, expected = {}) {
+  reserve(sessionID, purpose, expected = {}) {
     const queue = this.#receipts.get(sessionID) ?? [];
     for (let i = queue.length - 1;i >= 0; i -= 1) {
       const receipt = queue[i];
@@ -32436,11 +32951,9 @@ class NativeReceiptStore {
         continue;
       if (expected.callID !== undefined && receipt.callID !== expected.callID || expected.selectedLabel !== undefined && normalizeReceiptLabel(receipt.selectedLabel) !== normalizeReceiptLabel(expected.selectedLabel) || expected.selectedDescription !== undefined && receipt.selectedDescription !== expected.selectedDescription || expected.decisionPurpose !== undefined && receipt.decisionPurpose !== expected.decisionPurpose || expected.contentDigest !== undefined && receipt.contentDigest !== expected.contentDigest || expected.question !== undefined && receipt.question !== expected.question)
         continue;
-      queue.splice(i, 1);
-      if (!queue.length)
-        this.#receipts.delete(sessionID);
       const observation = { receipt };
       this.#observations.add(observation);
+      this.#reservations.set(observation, receipt);
       return { ok: true, receipt, observation };
     }
     return {
@@ -32466,6 +32979,26 @@ class NativeReceiptStore {
       })()
     };
   }
+  commit(observation) {
+    const receipt = this.#reservations.get(observation);
+    this.#reservations.delete(observation);
+    if (!receipt)
+      return false;
+    const queue = this.#receipts.get(receipt.sessionID) ?? [];
+    const index = queue.indexOf(receipt);
+    if (index < 0)
+      return false;
+    queue.splice(index, 1);
+    if (!queue.length)
+      this.#receipts.delete(receipt.sessionID);
+    return true;
+  }
+  consume(sessionID, purpose, expected = {}) {
+    const reserved = this.reserve(sessionID, purpose, expected);
+    if (reserved.ok)
+      this.commit(reserved.observation);
+    return reserved;
+  }
   verify(observation, sessionID, purpose) {
     if (typeof observation !== "object" || observation === null || !this.#observations.has(observation))
       return null;
@@ -32540,15 +33073,6 @@ var sessionData = async (client, sessionID) => {
     return null;
   }
 };
-var sameWorkspace = (expected, observed) => {
-  if (typeof observed !== "string" || !observed)
-    return false;
-  try {
-    return realpathSync9(expected) === realpathSync9(observed);
-  } catch {
-    return path24.resolve(expected) === path24.resolve(observed);
-  }
-};
 var hostRef = (handle) => ({ kind: "host", host: "opencode", handle });
 var opencodeCapabilities = () => [
   {
@@ -32717,6 +33241,10 @@ var nativeExternalActionRunner = (root, actor, core, step) => createAuthorizedEx
     settleObservation: (outcome, revisions) => nativeExternalActionObservation(actor, actionRef, outcome, actionRef.kind === "host" ? actionRef.handle : "external-action", revisions)
   };
 });
+var workerCoordinatorFor = (task, worker) => {
+  const coordinator = worker.data.coordinator ?? task.intent.provenance.session;
+  return coordinator?.kind === "host" && coordinator.host === "opencode" ? coordinator.handle : null;
+};
 var workerIdFor = (store, actor, current, directChildren) => {
   const parentID = sessionParent(current);
   if (!parentID)
@@ -32727,10 +33255,9 @@ var workerIdFor = (store, actor, current, directChildren) => {
   const matches = tasks.data.flatMap((task) => {
     if (task.status !== "active")
       return [];
-    const coordinator = task.intent.provenance.session;
-    if (coordinator?.kind !== "host" || coordinator.host !== "opencode" || coordinator.handle !== parentID || directChildren.get(actor) !== parentID)
+    if (directChildren.get(actor) !== parentID)
       return [];
-    return task.workers.filter((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.host === "opencode" && worker.data.session.handle === actor);
+    return task.workers.filter((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.host === "opencode" && worker.data.session.handle === actor && workerCoordinatorFor(task, worker) === parentID);
   });
   return matches.length === 1 ? matches[0].id : null;
 };
@@ -32790,10 +33317,11 @@ var createWorkitTools = ({
         };
         if (decision.response === "approved")
           expectation.selectedDescription = decision.binding.approvedContent;
-        const observed = receipts.consume(context.sessionID, "decision", expectation);
+        const observed = receipts.reserve(context.sessionID, "decision", expectation);
         if (!observed.ok)
           return output2(failure("permission_denied", observed.error));
         let recordInput = parsed.data;
+        let proposalToCommit;
         if (decision.purpose === "action" && decision.response === "approved") {
           const queue = actionProposals.get(context.sessionID) ?? [];
           const textMatches = queue.filter((pending) => pending.presented === decision.binding.presented && pending.approvedText === decision.binding.approvedContent);
@@ -32805,7 +33333,7 @@ var createWorkitTools = ({
             const fresh = resolveExternalActionRequest(context.directory, pending.request);
             const freshDescriptor = fresh.ok ? externalActionDescriptor(pending.request.operation, fresh.data.descriptorPayload) : null;
             if (freshDescriptor === pending.descriptor) {
-              actionProposals.set(context.sessionID, queue.filter((candidate) => candidate !== pending));
+              proposalToCommit = pending;
               recordInput = {
                 ...recordInput,
                 binding: {
@@ -32824,6 +33352,13 @@ var createWorkitTools = ({
           }
         }
         result = core.observeDecision(recordInput, observed.observation);
+        if (result.ok) {
+          receipts.commit(observed.observation);
+          if (proposalToCommit) {
+            const queue = actionProposals.get(context.sessionID) ?? [];
+            actionProposals.set(context.sessionID, queue.filter((candidate) => candidate !== proposalToCommit));
+          }
+        }
       } else {
         const run = core[family];
         result = run.call(core, parsed.data);
@@ -32879,7 +33414,7 @@ var createWorkitTools = ({
           return output2(failure("permission_denied", "child sessions cannot run external actions"));
         const store = new TaskStore(context.directory);
         const prior = priorExternalAction(store, "opencode", context.sessionID, resolved.data.request.operation, resolved.data.request.payload);
-        if (prior.ok && prior.data.entry.data.consumption !== null && prior.data.entry.data.consumption.state !== "uncertain")
+        if (prior.ok && prior.data.entry.data.consumption !== null && prior.data.entry.data.consumption.state !== "uncertain" && resolved.data.request.operation !== "git.commit" && resolved.data.request.operation !== "git.push")
           return output2(failure("permission_denied", "external action was already settled"));
         const reconciliationTokens = new WeakSet;
         const core = new WorkitCore(store, {
@@ -32962,6 +33497,16 @@ var createWorkitTools = ({
           }
         }
         const autoApplies = !selected.ok && !planAuthorized && standingAutoApplies(store, "opencode", context.sessionID, descriptor);
+        const planCount = planReservationLength(resolved.data.request.operation, resolved.data.descriptorPayload);
+        if (planCount !== null) {
+          if (selected.ok)
+            return output2(success(null, null, { plan_commits: planCount }));
+          if (autoApplies) {
+            const bound = standingAutoBinding(core, store, "opencode", context.sessionID, descriptor);
+            if (bound)
+              return output2(success(null, null, { plan_commits: planCount }));
+          }
+        }
         if (!selected.ok && !planAuthorized && !autoApplies) {
           if (selected.error.startsWith("no approved action")) {
             const proposal = actionProposalQuestion(resolved.data.request, resolved.data.descriptorPayload);
@@ -33090,9 +33635,9 @@ var loadProvenance = (logger, pkgUrl) => {
   }
 };
 
-// packages/workit-opencode/src/plugin.ts
-var root = fileURLToPath3(new URL("../assets/", import.meta.url));
-var skillsPath = path25.join(root, "skills");
+// packages/workit-opencode/src/v1/server.ts
+var root = assetsRoot();
+var skillsPath = path27.join(root, "skills");
 var logger = createLogger({
   appLog: () => {
     return;
@@ -33111,7 +33656,7 @@ var warnStaleSources = () => {
     logger.warn(EVENT.hooks, {
       boundary: "stale_sources",
       reason: "workit sources changed after plugin load; restart the session for latest behavior",
-      files: changed.map((file) => path25.basename(file))
+      files: changed.map((file) => path27.basename(file))
     });
   } catch {}
 };
@@ -33140,7 +33685,7 @@ var plugin = async ({ client, directory }) => {
   const dispatches = new Map;
   try {
     logger.info(EVENT.initialization, { host: "opencode", plugin_root: root });
-    logger.info(EVENT.provenance, loadProvenance(logger, new URL("../package.json", import.meta.url)));
+    logger.info(EVENT.provenance, loadProvenance(logger, path27.join(packageRoot2(), "package.json")));
   } catch (error) {
     logger.warn(EVENT.hooks, { boundary: "initialization", ...errorDetail(error) });
   }
@@ -33172,10 +33717,10 @@ var plugin = async ({ client, directory }) => {
     const listed = store.listTasks();
     if (!workspace.ok || !workspace.data || !listed.ok)
       return "unmanaged";
-    const owned = listed.data.filter((task) => task.status === "active" && task.workspaceId === workspace.data?.id && task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "opencode" && task.intent.provenance.session.handle === coordinator);
-    if (owned.length === 0)
+    const managed = listed.data.filter((task) => task.status === "active" && task.workspaceId === workspace.data?.id && (task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "opencode" && task.intent.provenance.session.handle === coordinator || task.workers.some((entry) => entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator) || workspace.data.writer?.owner.taskId === task.id && workspace.data.writer.owner.session.host === "opencode" && workspace.data.writer.owner.session.handle === coordinator));
+    if (managed.length === 0)
       return "unmanaged";
-    const eligible = owned.flatMap((task) => task.workers.filter((entry) => entry.data.state === "assigned" && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator).map((entry) => ({ task, entry })));
+    const eligible = managed.flatMap((task) => task.workers.filter((entry) => entry.data.state === "assigned" && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator).map((entry) => ({ task, entry })));
     const next = oldestOfSingleTask(eligible);
     if (!next)
       return "unbound";
@@ -33259,7 +33804,7 @@ var plugin = async ({ client, directory }) => {
       dispatches.delete(coordinator);
     return committed.ok;
   };
-  const observeLifecycle = async (sessionID, parentID, state, binding, initial = false, eventInfo) => {
+  const observeLifecycle = async (sessionID, parentID, state, binding, eventInfo, report) => {
     const store = new TaskStore(directory);
     const listed = store.listTasks();
     const workspace = store.readWorkspace();
@@ -33269,7 +33814,7 @@ var plugin = async ({ client, directory }) => {
     }
     const persisted = listed.data.flatMap((task) => task.status === "active" ? task.workers.filter((entry) => entry.id === binding?.workerId || entry.data.session?.kind === "host" && entry.data.session.handle === sessionID).map((entry) => ({ task, entry })) : []);
     const matches = persisted.filter(({ entry }) => entry.data.session?.kind === "host");
-    if (binding && !initial && matches.length !== 1) {
+    if (binding && matches.length !== 1) {
       droppedLifecycle(sessionID, "bound child worker handle is ambiguous");
       return;
     }
@@ -33278,7 +33823,7 @@ var plugin = async ({ client, directory }) => {
       droppedLifecycle(sessionID, binding ? "bound worker is missing from persisted state" : "worker session is ambiguous");
       return;
     }
-    if (!initial && selected.entry.data.session?.kind !== "host") {
+    if (selected.entry.data.session?.kind !== "host") {
       droppedLifecycle(sessionID, "selected worker has no bound host session");
       return;
     }
@@ -33286,25 +33831,26 @@ var plugin = async ({ client, directory }) => {
       droppedLifecycle(sessionID, "selected worker provenance is not host-observed");
       return;
     }
-    if (!binding) {
-      const coordinator = selected.task.intent.provenance.session;
-      if (coordinator?.kind !== "host" || coordinator.host !== "opencode") {
-        droppedLifecycle(sessionID, "coordinator session is not validated");
+    const observed = eventInfo ?? await sessionData2(client, sessionID);
+    if (binding && eventInfo) {
+      if (!deletedSessionEnd(directory, sessionID, parentID, observed)) {
+        droppedLifecycle(sessionID, "deleted session payload contradicts the binding");
         return;
       }
-      parentID = coordinator.handle;
+    } else if (!trustedSession(directory, sessionID, observed)) {
+      droppedLifecycle(sessionID, "live session observation is not trusted");
+      return;
     }
-    if (!initial) {
-      const observed = eventInfo ?? await sessionData2(client, sessionID);
-      if (binding && eventInfo) {
-        if (!deletedSessionEnd(directory, sessionID, parentID, observed)) {
-          droppedLifecycle(sessionID, "deleted session payload contradicts the binding");
-          return;
-        }
-      } else if (!trustedSession(directory, sessionID, observed) || observed.parentID !== parentID) {
-        droppedLifecycle(sessionID, "live session observation is not trusted");
+    if (!binding) {
+      const coordinator = workerCoordinatorFor(selected.task, selected.entry);
+      if (!coordinator || observed.parentID !== coordinator) {
+        droppedLifecycle(sessionID, "live session parent contradicts persisted coordinator");
         return;
       }
+      parentID = coordinator;
+    } else if (!eventInfo && observed.parentID !== parentID) {
+      droppedLifecycle(sessionID, "live session parent contradicts the binding");
+      return;
     }
     directChildren.set(sessionID, parentID);
     const core = new WorkitCore(store, {
@@ -33322,6 +33868,7 @@ var plugin = async ({ client, directory }) => {
       expectedWorkspaceRevision: workspace.data.revision,
       state,
       session: { kind: "host", host: "opencode", handle: sessionID },
+      ...report ? { report } : {},
       observation: { event: state, sessionID }
     });
     if (!result.ok) {
@@ -33337,25 +33884,9 @@ var plugin = async ({ client, directory }) => {
   const bindCreatedSession = async (info) => {
     if (typeof info.id !== "string" || typeof info.parentID !== "string" || !sameWorkspace(directory, info.directory))
       return;
-    const live = dispatches.get(info.parentID);
-    if (live)
-      live.generation.childCreated = true;
-    const store = new TaskStore(directory);
-    const workspace = store.readWorkspace();
-    const listed = store.listTasks();
-    if (!workspace.ok || !workspace.data || !listed.ok)
-      return;
-    const candidates = listed.data.flatMap((task) => task.status === "active" && task.workspaceId === workspace.data?.id ? task.workers.filter((entry) => (entry.data.state === "assigned" || entry.data.state === "dispatching") && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === info.parentID).map((entry) => ({ task, entry })) : []);
-    const next = oldestOfSingleTask(candidates);
-    if (!next)
-      return;
     directChildren.set(info.id, info.parentID);
-    if (live && live.taskId === next.task.id && live.workerId === next.entry.id && commitDispatchStart(info.parentID, info.id))
-      return;
-    await observeLifecycle(info.id, info.parentID, "running", {
-      taskId: next.task.id,
-      workerId: next.entry.id
-    }, true);
+    if (dispatches.has(info.parentID))
+      commitDispatchStart(info.parentID, info.id);
   };
   return {
     tool: tools,
@@ -33377,7 +33908,7 @@ var plugin = async ({ client, directory }) => {
         return;
       const binding = lifecycleBindings.get(sessionID);
       const state = event.type === "session.status" ? event.properties.status.type === "busy" ? "running" : event.properties.status.type === "idle" ? "stopped" : "unknown" : event.type === "session.idle" ? "stopped" : event.type === "session.deleted" ? "stopped" : "unknown";
-      await observeLifecycle(sessionID, binding?.parentID ?? "", state, binding, false, event.type === "session.deleted" ? properties.info : undefined);
+      await observeLifecycle(sessionID, binding?.parentID ?? "", state, binding, event.type === "session.deleted" ? properties.info : undefined);
     },
     "tool.execute.after": async (input, output) => {
       observeQuestion(receipts, input, output);
@@ -33403,7 +33934,12 @@ var plugin = async ({ client, directory }) => {
         if (completedChild) {
           const completionBinding = lifecycleBindings.get(completedChild);
           if (completionBinding)
-            await observeLifecycle(completedChild, input.sessionID, "stopped", completionBinding, false, undefined);
+            await observeLifecycle(completedChild, input.sessionID, "stopped", completionBinding, undefined, {
+              outcome: "completed",
+              summary: outputText.match(/<task_result>([\s\S]*?)<\/task_result>/)?.[1]?.trim() || outputText.trim() || "Native worker completed.",
+              evidenceIds: [],
+              findingIds: []
+            });
         } else if (!resolved && /(?:cancel|interrupt|unknown|uncertain)/.test(state))
           unresolvedTaskLaunches.add(input.sessionID);
       }
@@ -33442,7 +33978,7 @@ var plugin = async ({ client, directory }) => {
     config: async (config) => {
       const mutable = config;
       const paths = [...mutable.skills?.paths ?? []];
-      if (existsSync13(skillsPath) && !paths.includes(skillsPath))
+      if (existsSync14(skillsPath) && !paths.includes(skillsPath))
         paths.push(skillsPath);
       mutable.skills ??= {};
       mutable.skills.paths = paths;
@@ -33512,7 +34048,852 @@ var plugin = async ({ client, directory }) => {
     }
   };
 };
-var plugin_default = plugin;
+var server_default = plugin;
+
+// node_modules/@opencode/plugin/dist/promise/plugin.js
+function define(plugin) {
+  return plugin;
+}
+
+// packages/workit-opencode/src/shared/tools.ts
+var objectSchema = (properties, required) => ({
+  type: "object",
+  properties,
+  required,
+  additionalProperties: false
+});
+var WORKIT_EXTERNAL_ACTION_OPERATIONS = [
+  "git.branch_setup",
+  "git.commit",
+  "git.push",
+  "hosting.pull_request",
+  "hosting.merge",
+  "youtrack.update",
+  "youtrack.time",
+  "youtrack.meeting",
+  "changelog.apply",
+  "context.read"
+];
+var familyTools = OPERATION_FAMILIES.map((family) => ({
+  name: `workit_${family}`,
+  description: `Workit ${family} operations backed by the shared task contract.`,
+  input: { type: "object", ...boundedOperationJsonSchema(family, OPERATION_SCHEMA_DEPTH) }
+}));
+var WORKIT_TOOL_CATALOG = [
+  ...familyTools,
+  {
+    name: "workit_external_action",
+    description: `Run one fixed optional action. ${externalActionHelp}`,
+    input: objectSchema({
+      operation: {
+        type: "string",
+        enum: [...WORKIT_EXTERNAL_ACTION_OPERATIONS],
+        description: "Fixed optional action to run."
+      },
+      payload: {
+        type: "object",
+        description: "Operation-specific payload; Workit validates it.",
+        additionalProperties: true
+      }
+    }, ["operation", "payload"])
+  },
+  {
+    name: "workit_init_apply",
+    description: "Apply a confirmed toolkit initialization action",
+    input: objectSchema({
+      confirmed: { type: "boolean" },
+      action: {
+        type: "string",
+        enum: [
+          "youtrack_scaffold",
+          "youtrack_json",
+          "youtrack_token_placeholder",
+          "vcs_scaffold",
+          "config",
+          "gitignore",
+          "hygiene",
+          "branch_policy"
+        ]
+      },
+      base_url: { type: "string" },
+      default_mention: { type: "string" },
+      meeting_issue: { type: "string" },
+      vcs_provider: { type: "string", enum: ["gitlab", "github"] },
+      vcs_target_branch: { type: "string" },
+      name: { type: "string" },
+      develop_branch: { type: "string" },
+      integration: { type: "string", enum: ["pr", "merge"] },
+      locale: { type: "string" },
+      locale_options: { type: "array", items: { type: "string" } },
+      timezone: { type: "string" },
+      branch_policy_preset: {
+        type: "string",
+        enum: ["gitflow", "github-flow", "trunk-based", "custom"]
+      },
+      branch_policy_allowed: { type: "array", items: { type: "string" } },
+      branch_policy_protected: { type: "array", items: { type: "string" } },
+      include_open_source: { type: "boolean" }
+    }, ["confirmed", "action"])
+  }
+];
+var workitFamilyOf = (toolName) => {
+  for (const family of OPERATION_FAMILIES)
+    if (toolName === `workit_${family}`)
+      return family;
+  return null;
+};
+
+// packages/workit-opencode/src/v2/lifecycle.ts
+var record3 = (value) => typeof value === "object" && value !== null ? value : {};
+var sessionIDOf = (value) => typeof value === "string" && value.length > 0 ? value : null;
+var parentOf = (session) => typeof session?.parentID === "string" && session.parentID ? session.parentID : undefined;
+var contentText = (content) => {
+  if (typeof content === "string")
+    return content;
+  if (!Array.isArray(content))
+    return "";
+  return content.map((part) => record3(part).type === "text" ? String(part.text ?? "") : "").join(`
+`);
+};
+var createV2Lifecycle = (deps) => {
+  const { root } = deps;
+  const directChildren = new Map;
+  const dispatches = new Map;
+  const inflight = new Map;
+  const lifecycleBindings = new Map;
+  const unresolvedTaskLaunches = new Set;
+  const now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+  const readSession = async (sessionID) => {
+    try {
+      const info = await deps.getSession(sessionID);
+      if (!info || typeof info !== "object" || info.id !== sessionID)
+        return null;
+      return info;
+    } catch {
+      return null;
+    }
+  };
+  const trustedLead = async (coordinator) => {
+    const session = await readSession(coordinator);
+    if (!session || parentOf(session) !== undefined)
+      return null;
+    if (!sameWorkspace(root, session.directory))
+      return null;
+    return session;
+  };
+  const managedByCoordinator = (task, workspace, coordinator) => task.status === "active" && task.workspaceId === workspace.id && (task.intent.provenance.session?.kind === "host" && task.intent.provenance.session.host === "opencode" && task.intent.provenance.session.handle === coordinator || task.workers.some((entry) => entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator) || workspace.writer?.owner.taskId === task.id && workspace.writer.owner.session.host === "opencode" && workspace.writer.owner.session.handle === coordinator);
+  const ownsActiveTask = (coordinator) => {
+    try {
+      const store = new TaskStore(root);
+      const workspace = store.readWorkspace();
+      const listed = store.listTasks();
+      if (!workspace.ok || !workspace.data || !listed.ok)
+        return false;
+      return listed.data.some((task) => managedByCoordinator(task, workspace.data, coordinator));
+    } catch {
+      return false;
+    }
+  };
+  const revisions = (taskId) => {
+    const store = new TaskStore(root);
+    const task = store.readTask(taskId);
+    const workspace = store.readWorkspace();
+    return task.ok && workspace.ok && workspace.data ? {
+      expectedRevision: task.data.revision,
+      expectedWorkspaceRevision: workspace.data.revision
+    } : null;
+  };
+  const oldestOfSingleTask = (items) => {
+    const tasks = new Set(items.map((item) => item.task.id));
+    if (tasks.size !== 1 || items.length === 0)
+      return null;
+    return [...items].sort((a, b) => a.entry.recordedAt < b.entry.recordedAt ? -1 : a.entry.recordedAt > b.entry.recordedAt ? 1 : a.entry.id < b.entry.id ? -1 : 1)[0];
+  };
+  const prepareDispatch = (coordinator, callID) => {
+    if (dispatches.has(coordinator))
+      return "unsettled";
+    const store = new TaskStore(root);
+    const workspace = store.readWorkspace();
+    const listed = store.listTasks();
+    if (!workspace.ok || !workspace.data || !listed.ok)
+      return "unmanaged";
+    const managed = listed.data.filter((task) => managedByCoordinator(task, workspace.data, coordinator));
+    if (managed.length === 0)
+      return "unmanaged";
+    const eligible = managed.flatMap((task) => task.workers.filter((entry) => entry.data.state === "assigned" && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator).map((entry) => ({ task, entry })));
+    const next = oldestOfSingleTask(eligible);
+    if (!next)
+      return "unbound";
+    const generation = {
+      coordinator,
+      callID,
+      childCreated: false,
+      noChild: false
+    };
+    const core = new WorkitCore(store, {
+      root,
+      caller: { host: "opencode", actor: coordinator },
+      capabilities: [],
+      constraints: [],
+      now,
+      nativeWorker: nativeDispatchFor(directChildren, coordinator, generation)
+    });
+    const prepared = core.prepareWorkerDispatch({
+      taskId: next.task.id,
+      workerId: next.entry.id,
+      expectedRevision: next.task.revision,
+      expectedWorkspaceRevision: workspace.data.revision,
+      observation: { stage: "prepare", sessionID: coordinator, callID }
+    });
+    if (!prepared.ok)
+      return "unbound";
+    dispatches.set(coordinator, {
+      generation,
+      dispatch: prepared.data,
+      core,
+      taskId: next.task.id,
+      workerId: next.entry.id,
+      callID,
+      childID: null
+    });
+    return "prepared";
+  };
+  const commitDispatchStart = (coordinator, childID) => {
+    const pending = dispatches.get(coordinator);
+    if (!pending)
+      return false;
+    pending.generation.childCreated = true;
+    pending.childID = childID;
+    const current = revisions(pending.taskId);
+    if (!current)
+      return false;
+    const committed = pending.core.commitWorkerDispatch({
+      ...current,
+      dispatch: pending.dispatch,
+      taskId: pending.taskId,
+      workerId: pending.workerId,
+      outcome: "started",
+      session: { kind: "host", host: "opencode", handle: childID },
+      observation: { event: "running", sessionID: childID }
+    });
+    if (!committed.ok)
+      return false;
+    dispatches.delete(coordinator);
+    if (inflight.get(coordinator) === pending.callID)
+      inflight.delete(coordinator);
+    lifecycleBindings.set(childID, {
+      parentID: coordinator,
+      taskId: pending.taskId,
+      workerId: pending.workerId
+    });
+    return true;
+  };
+  const observeLifecycle = async (sessionID, parentID, state, binding, deleted = false, report) => {
+    const store = new TaskStore(root);
+    const listed = store.listTasks();
+    const workspace = store.readWorkspace();
+    if (!listed.ok || !workspace.ok || !workspace.data)
+      return;
+    const persisted = listed.data.flatMap((task) => task.status === "active" ? task.workers.filter((entry) => entry.id === binding?.workerId || entry.data.session?.kind === "host" && entry.data.session.handle === sessionID).map((entry) => ({ task, entry })) : []);
+    const matches = persisted.filter(({ entry }) => entry.data.session?.kind === "host");
+    if (binding && matches.length !== 1)
+      return;
+    const selected = binding ? persisted.find(({ task, entry }) => task.id === binding.taskId && entry.id === binding.workerId) : matches.length === 1 ? matches[0] : undefined;
+    if (!selected)
+      return;
+    if (selected.entry.data.session?.kind !== "host")
+      return;
+    if (selected.entry.provenance.session?.kind !== "host")
+      return;
+    if (!binding && deleted)
+      return;
+    if (!deleted) {
+      const observed = await readSession(sessionID);
+      const observedParent = parentOf(observed);
+      if (!observed || !sameWorkspace(root, observed.directory) || !observedParent)
+        return;
+      if (!binding) {
+        const coordinator = workerCoordinatorFor(selected.task, selected.entry);
+        if (!coordinator || observedParent !== coordinator)
+          return;
+        parentID = coordinator;
+      } else if (observedParent !== parentID)
+        return;
+    }
+    directChildren.set(sessionID, parentID);
+    const core = new WorkitCore(store, {
+      root,
+      caller: { host: "opencode", actor: parentID },
+      capabilities: [],
+      constraints: [],
+      now,
+      nativeWorker: nativeWorkerFor(directChildren, parentID)
+    });
+    const result = core.observeWorkerLifecycle({
+      taskId: selected.task.id,
+      workerId: selected.entry.id,
+      expectedRevision: selected.task.revision,
+      expectedWorkspaceRevision: workspace.data.revision,
+      state,
+      session: { kind: "host", host: "opencode", handle: sessionID },
+      ...report ? { report } : {},
+      observation: { event: state, sessionID }
+    });
+    if (!result.ok)
+      return;
+    lifecycleBindings.set(sessionID, {
+      parentID,
+      taskId: selected.task.id,
+      workerId: selected.entry.id
+    });
+  };
+  const reconcilePending = async (coordinator) => {
+    const pending = dispatches.get(coordinator);
+    if (!pending?.childID)
+      return;
+    const info = await readSession(pending.childID);
+    if (!info || info.id !== pending.childID || !info.outcome)
+      return;
+    await observeLifecycle(pending.childID, coordinator, "stopped", {
+      taskId: pending.taskId,
+      workerId: pending.workerId
+    });
+    dispatches.delete(coordinator);
+    if (inflight.get(coordinator) === pending.callID)
+      inflight.delete(coordinator);
+  };
+  const coordinatorVeto = (coordinator) => {
+    const listed = new TaskStore(root).listTasks();
+    if (listed.ok && listed.data.some((task) => task.workers.some((worker) => (worker.data.state === "cancelling" || worker.data.state === "unknown") && worker.provenance.session?.kind === "host" && worker.provenance.session.handle === coordinator)))
+      return "recovery_required: a cancelled worker remains uncertain; repeat worker.cancel on the ended worker to confirm its stop, then retry";
+    if (unresolvedTaskLaunches.delete(coordinator))
+      return "recovery_required: a cancelled worker remains uncertain";
+    return null;
+  };
+  const executeBefore = async (event) => {
+    if (event.tool !== "subagent")
+      return;
+    const coordinator = event.sessionID;
+    const continuation = record3(event.input).sessionID;
+    if (continuation !== undefined) {
+      const lead = await trustedLead(coordinator);
+      if (!lead)
+        throw new Error("delegation_lineage_denied: native subagent workers must be direct children of the coordinator");
+      const childID = sessionIDOf(continuation);
+      const child = childID ? await readSession(childID) : null;
+      if (!child || parentOf(child) !== coordinator)
+        throw new Error("delegation_lineage_denied: a continuation sessionID must name an existing direct child of the coordinator");
+      const listed = new TaskStore(root).listTasks();
+      const bound = listed.ok ? listed.data.filter((task) => task.workers.some((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.handle === childID && workerCoordinatorFor(task, worker) === coordinator)).length : 0;
+      if (bound !== 1 && ownsActiveTask(coordinator))
+        throw new Error("delegation_lineage_denied: a continuation sessionID must name a running Workit worker");
+      return;
+    }
+    if (!ownsActiveTask(coordinator)) {
+      const lead = await trustedLead(coordinator);
+      if (!lead)
+        throw new Error("delegation_lineage_denied: native subagent workers must be direct children of the coordinator");
+      return;
+    }
+    if (inflight.has(coordinator)) {
+      await reconcilePending(coordinator);
+      if (inflight.has(coordinator))
+        throw new Error("recovery_required: a previous fresh subagent launch is unsettled; wait for it to settle or reconcile its worker before launching again");
+    }
+    inflight.set(coordinator, event.id);
+    try {
+      const veto = coordinatorVeto(coordinator);
+      if (veto)
+        throw new Error(veto);
+      const lead = await trustedLead(coordinator);
+      if (!lead)
+        throw new Error("delegation_lineage_denied: native subagent workers must be direct children of the coordinator");
+      const prepared = prepareDispatch(coordinator, event.id);
+      if (prepared === "unmanaged") {
+        inflight.delete(coordinator);
+        return;
+      }
+      if (prepared === "unsettled") {
+        throw new Error("recovery_required: a previous native task launch is unsettled; wait for it to settle or reconcile its worker before launching again");
+      }
+      if (prepared === "unbound") {
+        throw new Error("recovery_required: no assigned Workit worker is attributable to this coordinator; assign one with workit_worker before launching a native task");
+      }
+    } catch (error) {
+      if (inflight.get(coordinator) === event.id)
+        inflight.delete(coordinator);
+      throw error;
+    }
+  };
+  const executeAfter = async (event) => {
+    if (event.tool !== "subagent")
+      return;
+    const coordinator = event.sessionID;
+    const pending = dispatches.get(coordinator);
+    const generation = pending?.callID === event.id ? pending : undefined;
+    if (event.status === "completed") {
+      const metadata = record3(event.result.metadata);
+      const child = sessionIDOf(metadata.sessionID ?? metadata.sessionId);
+      if (child) {
+        const childSession = await readSession(child);
+        if (parentOf(childSession) === coordinator) {
+          directChildren.set(child, coordinator);
+          if (generation)
+            commitDispatchStart(coordinator, child);
+        }
+      }
+      const output = contentText(event.result.content);
+      const completedChild = child && /<subagent\b[^>]*\bstate="completed"/.test(output) && lifecycleBindings.has(child) ? child : null;
+      if (completedChild) {
+        const binding = lifecycleBindings.get(completedChild);
+        if (binding)
+          await observeLifecycle(completedChild, coordinator, "stopped", binding, false, {
+            outcome: "completed",
+            summary: output.trim() || "Native worker completed.",
+            evidenceIds: [],
+            findingIds: []
+          });
+      }
+    } else {
+      const message = String(event.error?.message ?? event.error ?? "").toLowerCase();
+      if (generation && /(?:cancel|interrupt|unknown|uncertain)/.test(message))
+        unresolvedTaskLaunches.add(coordinator);
+    }
+    if (generation) {
+      dispatches.delete(coordinator);
+      if (inflight.get(coordinator) === event.id)
+        inflight.delete(coordinator);
+    } else if (inflight.get(coordinator) === event.id) {
+      inflight.delete(coordinator);
+    }
+  };
+  const bindCreatedSession = async (data) => {
+    if (!sameWorkspace(root, data.directory))
+      return;
+    directChildren.set(data.sessionID, data.parentID);
+    const live = dispatches.get(data.parentID);
+    if (live) {
+      live.childID = data.sessionID;
+      commitDispatchStart(data.parentID, data.sessionID);
+    }
+  };
+  const handleEvent = async (event) => {
+    const type = event.type;
+    if (typeof type !== "string")
+      return;
+    if (type === "session.created") {
+      const data = record3(event.data);
+      const sessionID = sessionIDOf(data.sessionID);
+      const parentID = sessionIDOf(data.parentID);
+      const directory = record3(data.location).directory;
+      if (!sessionID || !parentID || typeof directory !== "string")
+        return;
+      await bindCreatedSession({ sessionID, parentID, directory });
+      return;
+    }
+    const terminal = type === "session.execution.succeeded" || type === "session.execution.failed" || type === "session.execution.interrupted";
+    if (type !== "session.execution.started" && !terminal && type !== "session.deleted")
+      return;
+    const sessionID = sessionIDOf(record3(event.data).sessionID);
+    if (!sessionID)
+      return;
+    const binding = lifecycleBindings.get(sessionID);
+    if (type === "session.deleted") {
+      const directory = event.location?.directory;
+      if (typeof directory === "string" && !sameWorkspace(root, directory))
+        return;
+      await observeLifecycle(sessionID, binding?.parentID ?? "", "stopped", binding, true);
+      return;
+    }
+    const state = type === "session.execution.started" ? "running" : "stopped";
+    await observeLifecycle(sessionID, binding?.parentID ?? "", state, binding);
+  };
+  return {
+    directChildren,
+    executeBefore,
+    executeAfter,
+    handleEvent,
+    pendingLaunch: (coordinator) => inflight.has(coordinator)
+  };
+};
+
+// packages/workit-opencode/src/v2/injection.ts
+var textPart = (text) => ({ type: "text", text });
+var hasMarker = (system, marker) => system.some((part) => part.type === "text" && typeof part.text === "string" && part.text.includes(marker));
+var injectAgentContext = (root, session, directChildren, system) => {
+  if (!session || !sameWorkspace(root, session.directory))
+    return;
+  const bootstrap = session.parentID === undefined ? getWorkitBootstrap() : null;
+  const taskContext = compactContextFor(root, session.id);
+  const workerContext = session.parentID ? workerContextFor(root, session.id, session.parentID, directChildren) : null;
+  if (bootstrap && !hasMarker(system, "<workit-contract>"))
+    system.unshift(textPart(bootstrap));
+  if (taskContext && !hasMarker(system, "<workit-task-context>"))
+    system.unshift(textPart(`<workit-task-context>${taskContext}</workit-task-context>`));
+  if (workerContext && !hasMarker(system, "<workit-worker-context>"))
+    system.unshift(textPart(`<workit-worker-context>${workerContext}</workit-worker-context>`));
+};
+var injectCompactionContext = (root, sessionID, system) => {
+  const context = compactContextFor(root, sessionID);
+  if (!context || hasMarker(system, "<workit-task-context>"))
+    return;
+  system.push(textPart(`<workit-task-context>${context}</workit-task-context>`));
+};
+
+// packages/workit-opencode/src/v2/permissions.ts
+var GIT_WORKTREE = /git [\s\S]*worktree/u;
+var WORKTREE_MESSAGE = "Workit does not use git worktrees; use the guarded in-place git.branch_setup route instead";
+var evaluateShellPermission = (root, event) => {
+  if (event.action !== "shell" || event.effect === "deny")
+    return;
+  for (const resource of event.resources) {
+    if (typeof resource !== "string")
+      continue;
+    const route = shouldDenyShellRoute(root, resource);
+    if (route) {
+      event.effect = "deny";
+      event.message = `direct branch or PR creation bypasses the Workit route; ${route.guidance}`;
+      return;
+    }
+    if (GIT_WORKTREE.test(resource)) {
+      event.effect = "deny";
+      event.message = WORKTREE_MESSAGE;
+      return;
+    }
+  }
+};
+
+// packages/workit-opencode/src/v2/receipts.ts
+var normalizeQuestionAnswers = (answers) => {
+  const singleValue = (value) => typeof value === "string" && value.trim() ? value : null;
+  if (answers === null || typeof answers !== "object")
+    return answers;
+  if (Array.isArray(answers)) {
+    if (answers.length === 0)
+      return answers;
+    const first = answers[0];
+    const direct = singleValue(first);
+    if (direct)
+      return [[direct]];
+    if (Array.isArray(first)) {
+      if (first.length !== 1)
+        return answers;
+      const only = singleValue(first[0]);
+      return only ? [[only]] : answers;
+    }
+    if (first && typeof first === "object") {
+      const values = Object.values(first);
+      if (values.length === 1 && singleValue(values[0]) !== null)
+        return [[singleValue(values[0])]];
+    }
+    return answers;
+  }
+  const values = Object.values(answers);
+  if (values.length === 1 && singleValue(values[0]) !== null)
+    return [[singleValue(values[0])]];
+  return answers;
+};
+
+// packages/workit-opencode/src/v2/registry.ts
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "node:fs";
+import path28 from "node:path";
+var parseFrontmatter = (markdown) => {
+  const match = markdown.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  if (!match)
+    return { name: "", body: markdown };
+  const meta = {};
+  for (const line of match[1].split(`
+`)) {
+    const index = line.indexOf(":");
+    if (index > 0)
+      meta[line.slice(0, index).trim()] = line.slice(index + 1).trim();
+  }
+  return {
+    name: (meta.name ?? "").replace(/^["']|["']$/g, "").trim(),
+    description: (meta.description ?? "").replace(/^["']|["']$/g, "").trim() || undefined,
+    body: `${match[2].trim()}
+`
+  };
+};
+var registerSkills = async (ctx) => {
+  const skillsDir = path28.join(assetsRoot(), "skills");
+  if (!existsSync15(skillsDir))
+    return;
+  await ctx.skill.transform((editor) => {
+    const existing = new Set(editor.list().map((skill) => skill.id));
+    for (const id of WORKIT_METHOD_SKILLS) {
+      if (existing.has(id))
+        continue;
+      const file = path28.join(skillsDir, id, "SKILL.md");
+      if (!existsSync15(file))
+        continue;
+      const parsed = parseFrontmatter(readFileSync14(file, "utf8"));
+      editor.add({
+        id,
+        name: parsed.name || id,
+        ...parsed.description ? { description: parsed.description } : {},
+        location: file,
+        content: parsed.body
+      });
+    }
+  });
+};
+var registerCommands = async (ctx) => {
+  const listed = await ctx.command.list();
+  const existing = new Set((listed?.data ?? []).map((command) => command.name));
+  await ctx.command.transform((editor) => {
+    for (const [alias, skill] of Object.entries(WORKIT_SKILL_ALIASES)) {
+      if (existing.has(alias))
+        continue;
+      editor.add({
+        name: alias,
+        description: `Apply the ${skill} method skill to the current task.`,
+        execute: async ({ sessionID, prompt, delivery }) => {
+          await ctx.session.prompt({
+            sessionID,
+            text: `Load the ${skill} skill with the skill tool and apply it to the current task. Arguments: ${prompt.text}`,
+            ...prompt.files ? { files: prompt.files } : {},
+            ...prompt.agents ? { agents: prompt.agents } : {},
+            ...prompt.skills ? { skills: prompt.skills } : {},
+            delivery
+          });
+        }
+      });
+    }
+  });
+};
+
+// packages/workit-opencode/src/v2/plugin.ts
+var sessionFacts = async (ctx, sessionID) => {
+  try {
+    const session = await ctx.session.get({ sessionID });
+    const id = session?.id;
+    const directory = session?.location?.directory;
+    if (typeof id !== "string" || id !== sessionID || typeof directory !== "string")
+      return null;
+    const parentID = typeof session.parentID === "string" ? session.parentID : undefined;
+    const outcome = session.outcome === "succeeded" || session.outcome === "failed" || session.outcome === "interrupted" ? session.outcome : undefined;
+    return { id, parentID, directory, outcome };
+  } catch {
+    return null;
+  }
+};
+var resultContent = (value) => ({
+  content: JSON.stringify(value, null, 2)
+});
+var v2Capabilities = () => [
+  {
+    name: "interactive_decision",
+    surface: "question",
+    assurance: "enforced",
+    reason: "native question answers are observed by tool.execute.after and consumed once",
+    refs: [{ kind: "host", host: "opencode", handle: "question" }]
+  },
+  {
+    name: "known_product_writes",
+    surface: "edit/shell",
+    assurance: "unavailable",
+    reason: "file writes are host-policy; OpenCode native permissions govern them, workit no longer gates write tools",
+    refs: [{ kind: "host", host: "opencode", handle: "permission.evaluate" }]
+  },
+  {
+    name: "direct_child_workers",
+    surface: "subagent",
+    assurance: "enforced",
+    reason: "nested subagent launches are denied and observed child sessions are parent-bound before they may own a worker",
+    refs: [{ kind: "host", host: "opencode", handle: "subagent" }]
+  },
+  {
+    name: "fresh-context-review",
+    surface: "subagent",
+    assurance: "agent_guided",
+    reason: "independent review runs as a native child session; evidence evaluation enforces creator and duplicate-reviewer exclusion",
+    refs: [{ kind: "host", host: "opencode", handle: "subagent" }]
+  }
+];
+var workerIdFor2 = (store, actor, parentID, directChildren) => {
+  if (parentID === undefined)
+    return null;
+  const tasks = store.listTasks();
+  if (!tasks.ok)
+    return null;
+  const matches = tasks.data.flatMap((task) => {
+    if (task.status !== "active")
+      return [];
+    if (directChildren.get(actor) !== parentID)
+      return [];
+    return task.workers.filter((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.host === "opencode" && worker.data.session.handle === actor && workerCoordinatorFor(task, worker) === parentID);
+  });
+  return matches.length === 1 ? matches[0].id : null;
+};
+var recordDecision = (core, receipts, request, sessionID) => {
+  const decision = request;
+  if (decision.response === "stated")
+    return core.observeDecision(request, undefined);
+  const content = decisionContent(decision.purpose, decision.binding.presented, decision.binding.approvedContent);
+  const budgetIssue = workitBindingQuestionIssue([content]);
+  if (budgetIssue)
+    return failure("invalid_input", budgetIssue);
+  const observed = receipts.reserve(sessionID, "decision", {
+    selectedLabel: decision.response,
+    decisionPurpose: decision.purpose,
+    contentDigest: sha256(canonicalJson(content)),
+    question: decision.binding.presented,
+    ...decision.response === "approved" ? { selectedDescription: decision.binding.approvedContent } : {}
+  });
+  if (!observed.ok)
+    return failure("permission_denied", observed.error);
+  if (decision.purpose === "action" && decision.response === "approved" && !isSelfAuthorizingActionContent(decision.binding.approvedContent))
+    return failure("invalid_input", "no matching action proposal; resolve the action through the action tool first");
+  const result = core.observeDecision(request, observed.observation);
+  if (result.ok)
+    receipts.commit(observed.observation);
+  return result;
+};
+var setup = async (ctx) => {
+  const root = ctx.location.directory;
+  const sourceMarker = markSourcesLoaded(pluginSourceFiles);
+  let staleSourcesWarned = false;
+  const receipts = new NativeReceiptStore;
+  const lifecycle = createV2Lifecycle({
+    root,
+    getSession: async (sessionID) => {
+      const session = await sessionFacts(ctx, sessionID);
+      return session ? {
+        id: session.id,
+        parentID: session.parentID,
+        directory: session.directory,
+        outcome: session.outcome
+      } : null;
+    }
+  });
+  const runFamily = (family, input, session, store, workerId) => {
+    const parsed = parseOperation(family, input);
+    if (!parsed.ok)
+      return parsed;
+    const core = new WorkitCore(store, {
+      root,
+      caller: { host: "opencode", actor: session.id },
+      capabilities: v2Capabilities(),
+      constraints: [],
+      now: () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
+      workerId,
+      nativeAuthority: nativeAuthority(receipts, session.id),
+      nativeWorker: nativeWorkerFor(lifecycle.directChildren, session.id)
+    });
+    if (family === "decision" && parsed.data.action === "record")
+      return recordDecision(core, receipts, parsed.data, session.id);
+    const run = core[family];
+    return run.call(core, parsed.data);
+  };
+  await ctx.tool.transform((editor) => {
+    for (const spec of WORKIT_TOOL_CATALOG) {
+      editor.add({
+        name: spec.name,
+        description: spec.description,
+        input: spec.input,
+        options: { codemode: false },
+        execute: async (input, tool) => {
+          const session = await sessionFacts(ctx, tool.sessionID);
+          if (session === null || !sameWorkspace(root, session.directory))
+            return resultContent(failure("permission_denied", "OpenCode session location does not match the plugin checkout"));
+          const store = new TaskStore(root);
+          const workerId = workerIdFor2(store, session.id, session.parentID, lifecycle.directChildren);
+          if (session.parentID !== undefined && workerId === null)
+            return resultContent(failure("permission_denied", "OpenCode child session has no validated Workit worker"));
+          const family = workitFamilyOf(spec.name);
+          if (family !== null)
+            return resultContent(runFamily(family, input, session, store, workerId));
+          if (spec.name === "workit_external_action") {
+            const parsed = externalActionRequest(input);
+            if (!parsed.ok)
+              return resultContent(parsed);
+            if (parsed.data.operation !== "context.read")
+              return resultContent(failure("capability_unavailable", "OpenCode V2 external action approvals are not available yet; only context.read is", { capability: "external_action", outcome: "not_started" }));
+            const resolved = resolveExternalActionRequest(root, parsed.data);
+            if (!resolved.ok)
+              return resultContent(resolved);
+            return resultContent(await executeResolvedExternalAction(resolved.data, root));
+          }
+          if (spec.name === "workit_init_apply") {
+            return { content: executeInitApply(input, root, initApplyRuntime) };
+          }
+          return resultContent(failure("not_found", `unknown Workit tool ${spec.name}`));
+        }
+      });
+    }
+  });
+  await ctx.tool.hook("execute.before", async (event) => {
+    if (event.tool !== "subagent")
+      return;
+    await lifecycle.executeBefore({
+      tool: event.tool,
+      sessionID: String(event.sessionID),
+      id: String(event.id),
+      input: event.input
+    });
+  });
+  await ctx.tool.hook("execute.after", async (event) => {
+    if (event.tool === "question") {
+      if (event.status !== "completed")
+        return;
+      const metadata = event.result.metadata;
+      const answers = metadata?.answers;
+      receipts.record({ sessionID: String(event.sessionID), callID: String(event.id), args: event.input }, {
+        metadata: metadata === undefined ? undefined : { answers: normalizeQuestionAnswers(answers) }
+      });
+      return;
+    }
+    if (event.tool !== "subagent")
+      return;
+    await lifecycle.executeAfter({
+      tool: event.tool,
+      sessionID: String(event.sessionID),
+      id: String(event.id),
+      input: event.input,
+      ...event.status === "completed" ? { status: "completed", result: event.result } : { status: "error", error: event.error }
+    });
+  });
+  await ctx.permission.hook("evaluate", (event) => {
+    evaluateShellPermission(root, event);
+  });
+  await ctx.session.hook("context", async (event) => {
+    const session = await sessionFacts(ctx, String(event.sessionID));
+    injectAgentContext(root, session, lifecycle.directChildren, event.system);
+    if (!staleSourcesWarned) {
+      const changed = changedSourcesSinceLoad(sourceMarker);
+      if (changed.length > 0) {
+        staleSourcesWarned = true;
+        event.system.push({
+          type: "text",
+          text: `<workit-warning>Workit sources changed after plugin load (${changed.map((file) => file.split(/[\\/]/).at(-1)).join(", ")}); restart the session for latest behavior.</workit-warning>`
+        });
+      }
+    }
+  });
+  await ctx.session.hook("compaction", (event) => {
+    injectCompactionContext(root, String(event.sessionID), event.system);
+  });
+  await registerSkills(ctx);
+  await registerCommands(ctx);
+  const subscription = new AbortController;
+  (async () => {
+    try {
+      for await (const event of ctx.event.subscribe({ signal: subscription.signal })) {
+        await lifecycle.handleEvent(event);
+      }
+    } catch {}
+  })();
+  return () => {
+    subscription.abort();
+  };
+};
+var definition = define({ id: "workit", setup });
+var plugin_default = definition;
+
+// packages/workit-opencode/src/index.ts
+var src_default = { ...plugin_default, server: server_default };
 export {
-  plugin_default as default
+  src_default as default,
+  server_default as server
 };