@brainervirus/workit-opencode 8.14.1 → 8.15.1

package/assets/skills/workit-ship/SKILL.md

@@ -33,8 +33,8 @@ that repeats because the base keeps moving, or after 3 failed fix attempts on
 the same check.
 
 1. **Open.** `workit git push`, then `workit pr create --title "<title>"
-   --body-file <f|->` (idempotent; body: `references/pr-body.md`; edits:
-   `workit pr edit`). A stack: `workit stack plan <bottom> ... <top>`, one
+   --body-file <f|->` plus `--issue <#n|ID>` per issue (`--refs`: no close; idempotent;
+   body: `references/pr-body.md`; edits: `workit pr edit`). A stack: `workit stack plan <bottom> ... <top>`, one
    `workit pr create --base <parent> --fill` per branch, then
    `workit stack sync`. Finish the whole stack before babysitting any PR.
 2. **Read state** with `workit pr status --json`. `REVIEW` alone is a pending

package/dist/plugin.js

@@ -12384,6 +12384,7 @@ class TaskStore {
 var UNCERTAIN_WORKER_STATES = ["dispatching", "running", "cancelling", "unknown"];
 var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
 var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
+var holdsLiveState = (state, dirty) => state === "running" || dirty === true;
 
 // packages/workit-core/src/core/task-evaluation.ts
 import { createHash as createHash10 } from "node:crypto";
@@ -12630,6 +12631,36 @@ var line = (run) => {
   return value ? value : null;
 };
 var safeArg = (value) => value.length > 0 && !value.startsWith("-");
+var UNPARSEABLE = "<unparseable remote>";
+function redactRemote(raw) {
+  const value = raw.trim();
+  if (!value)
+    return UNPARSEABLE;
+  if (/^[A-Za-z][A-Za-z0-9+.-]*::/u.test(value))
+    return UNPARSEABLE;
+  if (/^[A-Za-z]:[\\/]/u.test(value) || value.startsWith("/") || value.startsWith("."))
+    return value;
+  if (!/[:@]/u.test(value))
+    return value;
+  if (!value.includes("://")) {
+    if (/^[^/@]*:[^/]*@/u.test(value))
+      return UNPARSEABLE;
+    const scp = /^(?:([^@\s/:]+)@)?([^:/\s]+):([^?#]+)/u.exec(value);
+    return scp ? `${scp[1] ? `${scp[1]}@` : ""}${scp[2]}:${scp[3]}` : UNPARSEABLE;
+  }
+  try {
+    const url = new URL(value);
+    const ssh = /^(?:ssh|git\+ssh|ssh\+git):$/u.test(url.protocol);
+    url.password = "";
+    if (!ssh)
+      url.username = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return UNPARSEABLE;
+  }
+}
 function headSha(cwd) {
   return line(git2(cwd, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]));
 }
@@ -12776,6 +12807,52 @@ function pushRemoteName(cwd, branch) {
     return "origin";
   return remotes.length === 1 ? remotes[0] : null;
 }
+function pushUrl(cwd, remote) {
+  if (!safeArg(remote))
+    return null;
+  const urls = git2(cwd, ["remote", "get-url", "--push", "--all", remote]).stdout.split(/\r?\n/u).map((value) => value.trim()).filter(Boolean);
+  return urls.length === 1 ? urls[0] : null;
+}
+var cleanPath = (value) => value.replace(/^\/+/u, "").replace(/\/+$/u, "").replace(/\.git$/u, "");
+function parseRemoteUrl(raw) {
+  const value = raw.trim();
+  if (!value || /^[A-Za-z][A-Za-z0-9+.-]*::/u.test(value))
+    return null;
+  if (/^[A-Za-z]:[\\/]/u.test(value) || value.startsWith("/") || value.startsWith(".")) {
+    return { protocol: "file", user: null, host: "", port: null, path: value };
+  }
+  if (!value.includes("://")) {
+    if (/^[^/@]*:[^/]*@/u.test(value))
+      return null;
+    const scp = /^(?:([^@\s/:]+)@)?([^:/\s]+):(.+)$/u.exec(value);
+    if (!scp)
+      return null;
+    return {
+      protocol: "ssh",
+      user: scp[1] ?? null,
+      host: scp[2],
+      port: null,
+      path: cleanPath(scp[3])
+    };
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  const scheme = url.protocol.replace(/:$/u, "");
+  const protocol = scheme === "ssh" || scheme === "git+ssh" || scheme === "ssh+git" ? "ssh" : scheme === "https" || scheme === "http" || scheme === "git" || scheme === "file" ? scheme : null;
+  if (!protocol)
+    return null;
+  return {
+    protocol,
+    user: protocol === "ssh" && url.username ? decodeURIComponent(url.username) : null,
+    host: url.hostname.replace(/\.$/u, ""),
+    port: url.port || null,
+    path: cleanPath(decodeURIComponent(url.pathname))
+  };
+}
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync4 } from "node:fs";
@@ -13186,20 +13263,19 @@ var workspaceConfigSchema = object({
     union([boolean2(), literal("verified")]).optional()
   ]))).passthrough().optional(),
   youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
-  issues: object({ provider: literal("github").optional(), link_on_pr: boolean2().optional() }).passthrough().optional(),
+  issues: object({
+    provider: _enum(["github", "gitlab", "youtrack"]).optional(),
+    link: boolean2().optional(),
+    relation: unknown().optional(),
+    backlink: boolean2().optional(),
+    link_on_pr: boolean2().optional()
+  }).passthrough().optional(),
   branchPolicy: workspaceBranchPolicySchema.optional(),
   commitPolicy: workspaceCommitPolicySchema.optional(),
   defaultProfile: nonBlank.optional(),
   profiles: record(nonBlank, workspaceProfileSchema).optional(),
   releaseTracks: record(nonBlank, releaseTrackSchema).optional()
 }).passthrough().superRefine((workspace, context) => {
-  if (workspace.issues && workspace.vcs?.provider !== "github") {
-    context.addIssue({
-      code: "custom",
-      path: ["issues"],
-      message: `GitHub issue linking requires the github provider, got ${workspace.vcs?.provider ?? "unset"}`
-    });
-  }
   if (workspace.defaultProfile !== undefined && !Object.hasOwn(workspace.profiles ?? {}, workspace.defaultProfile)) {
     context.addIssue({
       code: "custom",
@@ -14066,6 +14142,44 @@ var readVcsConfig = () => {
   }
   return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
 };
+var TRACKERS = new Set(["github", "gitlab", "youtrack"]);
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var flag = (value) => typeof value === "boolean" ? value : null;
+var text2 = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+function issueTrackerOf(issues, youtrack) {
+  const iss = asRecord(issues);
+  const yt = asRecord(youtrack);
+  const warnings = [];
+  const named = typeof iss.provider === "string" && TRACKERS.has(iss.provider.toLowerCase()) ? iss.provider.toLowerCase() : null;
+  if (iss.relation !== undefined && iss.relation !== "closes" && iss.relation !== "refs")
+    warnings.push(`issues.relation ${JSON.stringify(iss.relation)} is not closes or refs; read as closes`);
+  for (const key of ["repo", "host"])
+    if (iss[key] !== undefined && text2(iss[key]) === null)
+      warnings.push(`issues.${key} is not a non-empty string; ignored`);
+  const common = {
+    relation: iss.relation === "refs" ? "refs" : "closes",
+    backlink: iss.backlink === true,
+    baseUrl: text2(yt.baseUrl),
+    repo: text2(iss.repo)?.replace(/^\/+|\/+$/gu, "") ?? null,
+    host: text2(iss.host)?.toLowerCase() ?? null,
+    warnings
+  };
+  const legacyGithub = named === "github" && flag(iss.link) === null;
+  if (flag(yt.link_issues) === true && (named === null || legacyGithub))
+    return { provider: "youtrack", link: true, ...common, source: "youtrack.link_issues" };
+  if (named) {
+    const link = flag(iss.link) ?? flag(iss.link_on_pr) ?? (named === "youtrack" ? flag(yt.link_issues) : null) ?? false;
+    return {
+      provider: named,
+      link,
+      ...common,
+      source: flag(iss.link) === null && flag(iss.link_on_pr) !== null ? "issues.link_on_pr" : "issues"
+    };
+  }
+  if (common.baseUrl)
+    return { provider: "youtrack", link: false, ...common, source: "youtrack.baseUrl" };
+  return null;
+}
 var trackSummary = (resolution) => resolution.status === "resolved" ? {
   name: resolution.track?.name ?? null,
   source: resolution.source,
@@ -14086,6 +14200,7 @@ function vcsConfig(mode, cwd, options = {}) {
   const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
   const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
   const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
+  const issueTracker = issueTrackerOf(wsIssues, wsYt);
   const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
   const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   let issuesProvider = null;
@@ -14118,7 +14233,8 @@ function vcsConfig(mode, cwd, options = {}) {
       link_issues: linkIssues,
       youtrack_base_url: youtrackBaseUrl,
       issues_provider: issuesProvider,
-      link_on_pr: linkOnPr
+      link_on_pr: linkOnPr,
+      issue_tracker: issueTracker
     };
   }
   if (cfgStatus === "malformed") {
@@ -14144,7 +14260,8 @@ function vcsConfig(mode, cwd, options = {}) {
     link_issues: linkIssues,
     youtrack_base_url: youtrackBaseUrl,
     issues_provider: issuesProvider,
-    link_on_pr: linkOnPr
+    link_on_pr: linkOnPr,
+    issue_tracker: issueTracker
   };
   if (provider === "gitlab") {
     out.gitlab = {
@@ -14248,7 +14365,12 @@ var MAX_LINE_BYTES = 4096;
 var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
 var FAILING = new Set(["failed", "blocked"]);
 var STRONG_RESULTS = new Set(["verified", "tests-verified"]);
-var PR_ROW_TYPES = new Set(["pr.created", "pr.status", "pr.merged"]);
+var PR_ROW_TYPES = new Set([
+  "pr.created",
+  "pr.status",
+  "pr.merged",
+  "pr.linked"
+]);
 var err = (code, error, unblock) => ({
   ok: false,
   code,
@@ -16457,6 +16579,15 @@ var releaseBranchesOf = (cwd) => {
   }
 };
 var releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase());
+var policy = (root) => resolveBranchPolicyFor(root);
+var isProtected = (root, name) => policy(root).protected.has(name.toLowerCase());
+var isProtectedTarget = (root, name) => {
+  try {
+    return isProtected(root, name);
+  } catch {
+    return true;
+  }
+};
 
 // packages/workit-core/src/hooks/session-marker.ts
 import { createHash as createHash12 } from "node:crypto";
@@ -17906,7 +18037,7 @@ var rewrittenUrl = (url, config) => {
   }
   return url;
 };
-var pushUrl = (config, remote, dir) => {
+var pushUrl2 = (config, remote, dir) => {
   const configured = configValue(config, `remote.${remote}.pushurl`) ?? configValue(config, `remote.${remote}.url`);
   return normalizedUrl(rewrittenUrl(configured ?? remote, config), dir);
 };
@@ -17934,7 +18065,7 @@ var toPushRemote = (repo, remote, config) => {
   const pushRemote = pushRemoteOf(config, repo.branch);
   if (pushRemote === null || pushRemote === remote)
     return true;
-  return pushUrl(config, remote, repo.dir) === pushUrl(config, pushRemote, repo.dir);
+  return pushUrl2(config, remote, repo.dir) === pushUrl2(config, pushRemote, repo.dir);
 };
 var quote = (text) => `\`${text}\``;
 var refusal = (action, branch, dir) => {
@@ -18533,7 +18664,7 @@ var RISK = {
 };
 var YES = new Set(["true", "yes", "y", "1", "on"]);
 var NO = new Set(["false", "no", "n", "0", "off", "none"]);
-var flag = (value, unknownAs) => {
+var flag2 = (value, unknownAs) => {
   if (typeof value === "boolean")
     return { ok: true, value };
   if (typeof value === "number" && (value === 0 || value === 1))
@@ -18599,12 +18730,12 @@ function normalizeJudgment(raw, previous) {
       const items = Array.isArray(value) ? value : [value];
       judgment.refs.push(...items.filter((item) => item !== null && item !== "").map(refOf));
     } else {
-      if (name === "needsPlan" && typeof value === "string" && !flag(value, false).ok && value.trim()) {
+      if (name === "needsPlan" && typeof value === "string" && !flag2(value, false).ok && value.trim()) {
         judgment.needsPlan = true;
         judgment.refs.push(refOf(value.trim()));
         continue;
       }
-      const parsed = flag(value, name === "behaviorChange");
+      const parsed = flag2(value, name === "behaviorChange");
       if (parsed.ok)
         judgment[name] = parsed.value;
       else
@@ -20966,6 +21097,7 @@ import { spawnSync as spawnSync15 } from "node:child_process";
 import fs16 from "node:fs";
 import path22 from "node:path";
 import { spawnSync as spawnSync14 } from "node:child_process";
+import { pathToFileURL } from "node:url";
 // packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
   const m = /issues\/(\d+)/.exec(value);
@@ -20999,6 +21131,39 @@ var pushRemote = (cwd) => {
   const urls = (result.stdout ?? "").split(/\r?\n/u).map((url) => url.trim()).filter(Boolean);
   return urls.length === 1 ? urls[0] : null;
 };
+var safePushUrl = (remote) => {
+  const raw = remote.trim();
+  if (path22.isAbsolute(raw))
+    return pathToFileURL(raw).href;
+  if (!raw.includes("://")) {
+    const scp = /^(?:([^@\s]+)@)?([^:]+):(.+)$/u.exec(raw);
+    if (scp)
+      return `${scp[1] || "git"}@${scp[2]}:${scp[3]}`;
+  }
+  try {
+    const url = new URL(raw);
+    if (!["file:", "git:", "http:", "https:", "ssh:"].includes(url.protocol))
+      return null;
+    url.password = "";
+    if (url.protocol !== "ssh:")
+      url.username = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+};
+var pushTargetIsStable = (cwd, remote) => {
+  const target = safePushUrl(remote);
+  if (!target)
+    return false;
+  const result = spawnSync14("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
+  if (result.status !== 0 && result.status !== 1)
+    return false;
+  const prefixes = (result.stdout ?? "").split(/\r?\n/u).map((line) => line.trim().slice(line.trim().indexOf(" ") + 1)).filter(Boolean);
+  return !prefixes.some((prefix) => target.startsWith(prefix));
+};
 
 // packages/workit-core/src/core/tracker-issues.ts
 var repoPathFromRemote = (remote) => {
@@ -23451,10 +23616,494 @@ var workerCoordinatorFor = (task, worker) => {
   return coordinator?.kind === "host" && coordinator.host === "opencode" ? coordinator.handle : null;
 };
 
+// packages/workit-core/src/fanout.ts
+import { createHash as createHash16 } from "node:crypto";
+import fs21 from "node:fs";
+import path37 from "node:path";
+
+// packages/workit-core/src/stack.ts
+import { spawnSync as spawnSync21 } from "node:child_process";
+import { createHash as createHash15, randomBytes as randomBytes4 } from "node:crypto";
+import fs20 from "node:fs";
+import path36 from "node:path";
+
+// packages/workit-core/src/git/ops.ts
+import { spawnSync as spawnSync20 } from "node:child_process";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
+import path35 from "node:path";
+
+// packages/workit-core/src/forge/redact.ts
+var KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
+var ASSIGNMENT2 = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?([^\s"',;&]+)`, "giu");
+var QUOTED_ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*)(["'])([^"'\n]*[^\s"'][^"'\n]*)\2`, "giu");
+var ANSI = new RegExp(String.raw`\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007]*\u0007`, "gu");
+
+// packages/workit-core/src/forge/types.ts
+var success2 = (data) => ({ ok: true, data });
+var failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
+
+// packages/workit-core/src/git/ops.ts
+var COMMIT_TIMEOUT_MS = 10 * 60000;
+var git5 = (cwd, args, options = {}) => {
+  const result = spawnSync20("git", args, {
+    cwd,
+    encoding: "utf8",
+    env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    ...options.input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }
+  });
+  return {
+    ok: result.status === 0,
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? ""
+  };
+};
+function operationInProgress(cwd) {
+  const markers = [
+    ["rebase-merge", "rebase"],
+    ["rebase-apply", "rebase"],
+    ["MERGE_HEAD", "merge"],
+    ["CHERRY_PICK_HEAD", "cherry-pick"],
+    ["REVERT_HEAD", "revert"]
+  ];
+  const run = git5(cwd, ["rev-parse", ...markers.flatMap(([name]) => ["--git-path", name])]);
+  if (!run.ok)
+    return null;
+  const found = run.stdout.split(`
+`).map((line) => path35.resolve(cwd, line.trim()));
+  const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
+  for (const [index, [, operation]] of markers.entries()) {
+    const marker = found[index];
+    if (!marker || !existsSync11(marker))
+      continue;
+    if (index === 1 && existsSync11(path35.join(marker, "applying")))
+      return { operation: "am", commitAllowed: false, branch: null };
+    if (index === 0 && existsSync11(path35.join(marker, "amend")) && !conflicted()) {
+      let headName = "";
+      try {
+        headName = readFileSync9(path35.join(marker, "head-name"), "utf8").trim();
+      } catch {}
+      const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
+      return { operation, commitAllowed: branch !== null, branch };
+    }
+    if ((operation === "revert" || operation === "merge") && !conflicted())
+      return { operation, commitAllowed: true, branch: null };
+    return { operation, commitAllowed: false, branch: null };
+  }
+  return null;
+}
+function inProgressFailure(operation, verb) {
+  const command = operation === "am" ? "git am" : `git ${operation}`;
+  return failure3("blocked", `${operation.replace("-", "_")}_in_progress: a ${operation === "am" ? "git am" : operation} is in progress; finish or abort it before workit can ${verb}`, `resolve the conflicts, git add <files>, then ${command} --continue  # or ${command} --abort to return to where you started`);
+}
+function pushPreflight(cwd, options = {}) {
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "push");
+  const branch = options.branch ?? currentBranch(cwd);
+  if (!branch)
+    return failure3("invalid_input", "HEAD is detached; push a branch");
+  if (isProtectedTarget(cwd, branch))
+    return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit git push never pushes to it`, releaseBranch(cwd, branch) ? `workit git push --release ${branch}  # finishing a release or hotfix; needs the release grant` : "workit git branch <feature/name>  # push a feature branch and open a PR");
+  const sha = resolveRef(cwd, `refs/heads/${branch}`);
+  if (!sha)
+    return failure3("not_found", `branch ${branch} has no commit to push`);
+  const remote = pushRemoteName(cwd, branch);
+  if (!remote)
+    return failure3("not_found", "no push remote is configured for this branch", "git remote add origin <url>");
+  const raw = pushUrl(cwd, remote);
+  if (!raw)
+    return failure3("blocked", `remote "${remote}" has no single push URL`, `git remote get-url --push --all ${remote}  # keep exactly one push URL`);
+  const parsed = parseRemoteUrl(raw);
+  const local = parsed?.protocol === "file";
+  if (!local && !pushTargetIsStable(cwd, raw))
+    return failure3("blocked", `push_target_rewritten: the push URL of "${remote}" is rewritten by a url.*.insteadOf rule, so the destination is not the one checked`, "git config --get-regexp '^url\\.'  # remove the rewrite for this remote");
+  return success2({
+    branch,
+    sha,
+    remote,
+    url: redactRemote(raw),
+    rawUrl: raw,
+    local
+  });
+}
+
+// packages/workit-core/src/forge/report.ts
+var GITLAB_MERGEABLE = new Set(["mergeable"]);
+var GITHUB_MERGEABLE = new Set(["clean", "unstable", "has_hooks"]);
+
+// packages/workit-core/src/stack.ts
+var stackFail = (code, error, unblock, data) => ({
+  ok: false,
+  code,
+  error,
+  ...unblock ? { unblock } : {},
+  ...data ? { data } : {}
+});
+var stackDeps = {
+  pushPlan: (cwd, branch) => pushPreflight(cwd, { branch }),
+  adapter: { name: "git", restack: (cwd, input) => gitRestack(cwd, input) },
+  rebaseTimeoutMs: Number(process.env.WORKIT_STACK_REBASE_TIMEOUT_MS) || 10 * 60000
+};
+var gitRun3 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
+  const run = spawnSync21("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024,
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_EDITOR: "true",
+      GIT_SEQUENCE_EDITOR: "true",
+      LC_ALL: "C",
+      LANGUAGE: "C"
+    }
+  });
+  const failure = run.error;
+  return {
+    ok: run.status === 0,
+    stdout: run.stdout ?? "",
+    stderr: run.error ? String(run.error.message) : run.stderr ?? "",
+    timedOut: failure?.code === "ETIMEDOUT"
+  };
+};
+var branchTip = (cwd, branch) => resolveRef(cwd, `refs/heads/${branch}`);
+function worktreeOf(cwd, branch) {
+  const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
+  if (!list.ok)
+    return null;
+  let current = null;
+  for (const line of list.stdout.split(`
+`)) {
+    if (line.startsWith("worktree "))
+      current = line.slice("worktree ".length);
+    else if (line === `branch refs/heads/${branch}` && current)
+      return current;
+    else if (line === "detached" && current && rebasingBranch2(current) === `refs/heads/${branch}`)
+      return current;
+  }
+  return null;
+}
+function rebasingBranch2(dir) {
+  for (const name of ["rebase-merge/head-name", "rebase-apply/head-name"]) {
+    const found = gitRun3(dir, ["rev-parse", "--path-format=absolute", "--git-path", name]);
+    if (!found.ok)
+      continue;
+    try {
+      return fs20.readFileSync(found.stdout.trim(), "utf8").trim();
+    } catch {}
+  }
+  return null;
+}
+function rebaseInProgress(dir) {
+  for (const name of ["rebase-merge", "rebase-apply"]) {
+    const found = gitRun3(dir, ["rev-parse", "--path-format=absolute", "--git-path", name]);
+    if (found.ok && fs20.existsSync(found.stdout.trim()))
+      return true;
+  }
+  return false;
+}
+var scratchDir = (cwd) => {
+  const dir = stacksDir(cwd);
+  return dir.ok ? path36.join(dir.data, "worktrees") : null;
+};
+function gitRestack(cwd, input) {
+  const owner = worktreeOf(cwd, input.branch);
+  let dir = owner;
+  if (!dir) {
+    const scratch = scratchDir(cwd);
+    if (!scratch)
+      return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
+    fs20.mkdirSync(scratch, { recursive: true });
+    dir = path36.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
+    const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
+    if (!added.ok)
+      return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
+  }
+  const run = gitRun3(dir, [
+    "-c",
+    "rebase.autoStash=false",
+    "-c",
+    "rebase.updateRefs=false",
+    "rebase",
+    "--no-autosquash",
+    "--onto",
+    input.onto,
+    input.from
+  ], stackDeps.rebaseTimeoutMs);
+  if (!run.ok) {
+    if (run.timedOut)
+      return {
+        ok: false,
+        conflict: false,
+        timedOut: true,
+        worktree: dir,
+        error: `git rebase did not finish within ${stackDeps.rebaseTimeoutMs} ms`
+      };
+    if (rebaseInProgress(dir))
+      return { ok: false, conflict: true, worktree: dir, error: firstLine(run) };
+    if (!owner)
+      gitRun3(cwd, ["worktree", "remove", "--force", dir]);
+    return { ok: false, conflict: false, worktree: dir, error: firstLine(run) };
+  }
+  if (!owner)
+    gitRun3(cwd, ["worktree", "remove", "--force", dir]);
+  const head = branchTip(cwd, input.branch);
+  return head ? { ok: true, head } : { ok: false, conflict: false, worktree: dir, error: `${input.branch} vanished` };
+}
+var firstLine = (run) => (`${run.stderr}
+${run.stdout}`.split(`
+`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300);
+var stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash15("sha256").update(name).digest("hex").slice(0, 12)}.json`;
+function stacksDir(cwd) {
+  const root = storeRoot(cwd);
+  if (!root.ok)
+    return stackFail(root.code, root.error, root.unblock);
+  return { ok: true, data: path36.join(root.value.root, "stacks") };
+}
+var HEARTBEAT_STALE_MS = 2 * 60000;
+
+// packages/workit-core/src/fanout.ts
+var FANOUT_VERSION = 1;
+var TIERS = ["mundane", "standard", "hard"];
+var fanoutFail = (code, error, unblock, data) => ({
+  ok: false,
+  code,
+  error,
+  ...unblock ? { unblock } : {},
+  ...data ? { data } : {}
+});
+var compiled = new Map;
+function normalizePattern(raw) {
+  let pattern = raw.trim();
+  if (pattern.includes("\\")) {
+    if (/\\[*?{}]/u.test(pattern))
+      return {
+        error: "has \\*, \\?, \\{ or \\}: only \\[ and \\] are escapes; use / as the separator (src/**/*.ts)"
+      };
+    const brackets = /\\[[\]]/u.test(pattern);
+    if (brackets && pattern.replace(/\\[[\]]/gu, "").includes("\\"))
+      return {
+        error: "mixes \\[ or \\] escapes with other backslashes, which is ambiguous: use / as the separator (app/\\[id\\]/page.tsx)"
+      };
+    if (!brackets)
+      pattern = pattern.replaceAll("\\", "/");
+  }
+  while (pattern.startsWith("./"))
+    pattern = pattern.slice(2);
+  if (pattern === "." || pattern === "")
+    pattern = raw.trim() ? "**" : "";
+  if (pattern.endsWith("/"))
+    pattern = `${pattern}**`;
+  if (!pattern)
+    return { error: "is empty" };
+  if (pattern.startsWith("/") || /^[A-Za-z]:/u.test(pattern))
+    return { error: "must be relative to the repository root" };
+  if (pattern.split("/").includes(".."))
+    return { error: "must not contain .." };
+  const bare = pattern.replace(/\\./gu, "");
+  if (/[[\]]/u.test(bare))
+    return {
+      error: 'has an unescaped [ or ]: write \\[ and \\] for literal brackets (app/\\[id\\]/page.tsx; in JSON "app/\\\\[id\\\\]/page.tsx")'
+    };
+  if (bare.startsWith("!"))
+    return { error: "uses ! (negation is not supported)" };
+  let depth = 0;
+  for (const char of bare) {
+    if (char === "{")
+      depth += 1;
+    if (char === "}")
+      depth -= 1;
+    if (depth < 0 || depth > 1)
+      return { error: "has unbalanced or nested braces" };
+  }
+  if (depth !== 0)
+    return { error: "has unbalanced or nested braces" };
+  return { pattern };
+}
+var isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function findCycle(slices) {
+  const byId = new Map(slices.map((slice) => [slice.id, slice]));
+  const state = new Map;
+  const trail = [];
+  const visit = (id) => {
+    if (state.get(id) === "done")
+      return null;
+    if (state.get(id) === "open")
+      return [...trail.slice(trail.indexOf(id)), id];
+    state.set(id, "open");
+    trail.push(id);
+    for (const dep of byId.get(id)?.dependsOn ?? []) {
+      if (!byId.has(dep) || dep === id)
+        continue;
+      const found = visit(dep);
+      if (found)
+        return found;
+    }
+    trail.pop();
+    state.set(id, "done");
+    return null;
+  };
+  for (const slice of slices) {
+    const found = visit(slice.id);
+    if (found)
+      return found;
+  }
+  return null;
+}
+function sliceHash(slice) {
+  const {
+    worktree: _worktree,
+    hash: _hash,
+    hashSince: _since,
+    tier: _tier,
+    timebox: _timebox,
+    context: _context,
+    issues: _issues,
+    ...definition
+  } = slice;
+  return createHash16("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
+}
+function fanoutsDir(cwd) {
+  const root = storeRoot(cwd);
+  if (!root.ok)
+    return fanoutFail(root.code, root.error, root.unblock);
+  return { ok: true, data: path37.join(root.value.root, "fanouts") };
+}
+function parseStored(raw) {
+  if (!isRecord5(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
+    return null;
+  if (!Array.isArray(raw.slices))
+    return null;
+  const list = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+  const text = (value) => typeof value === "string" ? value : "";
+  let globsValid = true;
+  const globs = (value) => list(value).map((entry) => {
+    const normalized = normalizePattern(entry);
+    if ("error" in normalized) {
+      globsValid = false;
+      return entry;
+    }
+    return normalized.pattern;
+  });
+  const slices = [];
+  for (const item of raw.slices) {
+    if (!isRecord5(item) || typeof item.id !== "string" || typeof item.branch !== "string")
+      return null;
+    slices.push({
+      id: item.id,
+      branch: item.branch,
+      base: text(item.base) || raw.trunk,
+      worktree: text(item.worktree),
+      tier: TIERS.includes(item.tier) ? item.tier : "standard",
+      dependsOn: list(item.dependsOn),
+      scope: globs(item.scope),
+      owns: globs(item.owns),
+      goal: text(item.goal),
+      acceptance: list(item.acceptance),
+      verify: list(item.verify),
+      forbidden: list(item.forbidden),
+      context: typeof item.context === "string" ? item.context : null,
+      timebox: typeof item.timebox === "string" ? item.timebox : null,
+      issues: list(item.issues),
+      hash: text(item.hash),
+      hashSince: text(item.hashSince) || text(raw.createdAt)
+    });
+  }
+  for (const slice of slices)
+    slice.hash ||= sliceHash(slice);
+  const shared = globs(raw.shared);
+  const ids = new Set(slices.map((slice) => slice.id));
+  if (!globsValid || ids.size !== slices.length || slices.some((slice) => slice.dependsOn.some((dep) => dep === slice.id || !ids.has(dep))) || findCycle(slices))
+    return null;
+  const fanIn = raw.fanIn === "integration" ? "integration" : "prs";
+  const createdAt = text(raw.createdAt);
+  return {
+    v: typeof raw.v === "number" ? raw.v : FANOUT_VERSION,
+    name: raw.name,
+    trunk: raw.trunk,
+    fanIn,
+    shared,
+    slices,
+    leadSession: typeof raw.leadSession === "string" && raw.leadSession ? raw.leadSession : null,
+    formerLeads: list(raw.formerLeads),
+    createdAt,
+    updatedAt: text(raw.updatedAt)
+  };
+}
+function readFanout(cwd, name) {
+  const dir = fanoutsDir(cwd);
+  if (!dir.ok)
+    return dir;
+  const file = path37.join(dir.data, stackFileName(name));
+  let parsed = null;
+  try {
+    parsed = parseStored(JSON.parse(fs21.readFileSync(file, "utf8")));
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { ok: true, data: null };
+    parsed = null;
+  }
+  return parsed ? { ok: true, data: parsed } : fanoutFail("failed", `fanout file ${file} is not a valid plan`, `workit fanout plan <plan.json> --name ${name}  # rewrite it`);
+}
+function listFanouts(cwd) {
+  const dir = fanoutsDir(cwd);
+  if (!dir.ok)
+    return dir;
+  let names = [];
+  try {
+    names = fs21.readdirSync(dir.data).filter((entry) => entry.endsWith(".json"));
+  } catch {
+    return { ok: true, data: [] };
+  }
+  const out = [];
+  for (const entry of names) {
+    let parsed = null;
+    try {
+      parsed = parseStored(JSON.parse(fs21.readFileSync(path37.join(dir.data, entry), "utf8")));
+    } catch {
+      parsed = null;
+    }
+    if (parsed && stackFileName(parsed.name) === entry)
+      out.push(parsed);
+  }
+  return { ok: true, data: out.toSorted((a, b) => a.name.localeCompare(b.name)) };
+}
+function selectFanout(cwd, name, current) {
+  if (name) {
+    const read = readFanout(cwd, name);
+    if (!read.ok)
+      return read;
+    return read.data ? { ok: true, data: read.data } : fanoutFail("not_found", `no fanout plan named ${name}`, "workit fanout plan <plan.json>");
+  }
+  const all = listFanouts(cwd);
+  if (!all.ok)
+    return all;
+  const holding = all.data.filter((plan) => plan.slices.some((slice) => slice.branch === current));
+  if (holding.length === 1)
+    return { ok: true, data: holding[0] };
+  if (all.data.length === 1)
+    return { ok: true, data: all.data[0] };
+  return all.data.length === 0 ? fanoutFail("not_found", "no fanout plan is recorded here", "workit fanout plan <plan.json>") : fanoutFail("invalid_input", `several fanout plans match; pick one (${all.data.map((plan) => plan.name).join(", ")})`, "pass --name <plan>");
+}
+
 // packages/workit-opencode/src/v2/lifecycle.ts
 var record2 = (value) => typeof value === "object" && value !== null ? value : {};
 var sessionIDOf = (value) => typeof value === "string" && value.length > 0 ? value : null;
 var parentOf = (session) => typeof session?.parentID === "string" && session.parentID ? session.parentID : undefined;
+var resumeBriefCommand = (root, directory) => {
+  const branch = directory ? currentBranch(directory) : null;
+  const plan = branch ? selectFanout(root, null, branch) : null;
+  const slice = branch && plan?.ok ? plan.data.slices.find((entry) => entry.branch === branch || branch.startsWith(`${entry.branch}-try`) && /^\d+$/u.test(branch.slice(entry.branch.length + 4))) : undefined;
+  return `workit fanout brief ${slice?.id ?? "<slice>"} --mode resume`;
+};
 var contentText = (content) => {
   if (typeof content === "string")
     return content;
@@ -23710,8 +24359,12 @@ var createV2Lifecycle = (deps) => {
         throw new Error("delegation_lineage_denied: a continuation sessionID must name an existing direct child of the coordinator");
       const listed = new TaskStore(root).listTasks();
       const bound = listed.ok ? listed.data.filter((task) => task.workers.some((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.handle === childID && workerCoordinatorFor(task, worker) === coordinator)).length : 0;
-      if (bound !== 1 && ownsActiveTask(coordinator))
-        throw new Error("delegation_lineage_denied: a continuation sessionID must name a running Workit worker");
+      if (bound !== 1 && ownsActiveTask(coordinator)) {
+        const reported = listed.ok && listed.data.some((task) => task.workers.some((worker) => worker.data.state === "stopped" && worker.data.session?.kind === "host" && worker.data.session.handle === childID && workerCoordinatorFor(task, worker) === coordinator));
+        const dirty = reported && child.directory ? worktreeTree(child.directory)?.dirty ?? null : null;
+        if (!reported || !holdsLiveState("stopped", dirty))
+          throw new Error(reported ? `delegation_lineage_denied: this worker already reported and holds no live state (no running process, no uncommitted changes); continue the slice with a fresh worker: ${resumeBriefCommand(root, child.directory)}` : "delegation_lineage_denied: a continuation sessionID must name a running Workit worker");
+      }
       return;
     }
     if (!ownsActiveTask(coordinator)) {
@@ -24015,7 +24668,7 @@ var childTaskMissing = (store, input) => {
 var childDenial = (identity) => `OpenCode child session has no validated Workit worker: as ${identity} it may only record evidence or findings (workit_evidence/workit_finding action "record") on an existing task; for anything else the lead assigns it a worker with workit_worker before launching it`;
 
 // packages/workit-opencode/src/v2/shell.ts
-import path35 from "node:path";
+import path38 from "node:path";
 var commandOf = (input) => {
   if (input === null || typeof input !== "object")
     return null;
@@ -24024,7 +24677,7 @@ var commandOf = (input) => {
 };
 var hookInput = (root, sessionID, id, shell) => ({
   host: "opencode",
-  cwd: shell.workdir ? path35.resolve(root, shell.workdir) : root,
+  cwd: shell.workdir ? path38.resolve(root, shell.workdir) : root,
   session: { id: sessionID, agentId: null, agentType: null, parentId: null },
   permissionMode: null,
   transcriptPath: null,
@@ -24208,38 +24861,38 @@ var createStopControl = (root, port) => {
 };
 
 // packages/workit-opencode/src/v2/registry.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
-import path37 from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import path40 from "node:path";
 
 // packages/workit-opencode/src/shared/assets.ts
-import { existsSync as existsSync11, realpathSync as realpathSync9 } from "node:fs";
-import path36 from "node:path";
+import { existsSync as existsSync12, realpathSync as realpathSync9 } from "node:fs";
+import path39 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleDir = () => {
   try {
-    return realpathSync9(path36.dirname(fileURLToPath2(import.meta.url)));
+    return realpathSync9(path39.dirname(fileURLToPath2(import.meta.url)));
   } catch {
-    return path36.dirname(fileURLToPath2(import.meta.url));
+    return path39.dirname(fileURLToPath2(import.meta.url));
   }
 };
 var packageRoot2 = () => {
   const dir = moduleDir();
   for (const candidate of [
-    path36.resolve(dir, ".."),
-    path36.resolve(dir, "..", ".."),
-    path36.resolve(dir, "..", "..", "..")
+    path39.resolve(dir, ".."),
+    path39.resolve(dir, "..", ".."),
+    path39.resolve(dir, "..", "..", "..")
   ]) {
-    if (existsSync11(path36.join(candidate, "package.json")))
+    if (existsSync12(path39.join(candidate, "package.json")))
       return candidate;
   }
-  return path36.resolve(dir, "..");
+  return path39.resolve(dir, "..");
 };
 var skillsRoot = () => {
   const root = packageRoot2();
-  const canonical = path36.resolve(root, "..", "workit-core", "skills");
-  if (existsSync11(path36.join(root, "src")) && existsSync11(canonical))
+  const canonical = path39.resolve(root, "..", "workit-core", "skills");
+  if (existsSync12(path39.join(root, "src")) && existsSync12(canonical))
     return canonical;
-  return path36.join(root, "assets", "skills");
+  return path39.join(root, "assets", "skills");
 };
 
 // packages/workit-opencode/src/v2/registry.ts
@@ -24263,15 +24916,15 @@ var parseFrontmatter = (markdown) => {
 };
 var registerSkills = async (ctx) => {
   const skillsDir = skillsRoot();
-  if (!existsSync12(skillsDir))
+  if (!existsSync13(skillsDir))
     return new Set;
   const listed = await ctx.skill.list().catch(() => ({ data: [] }));
-  const own = (skill) => typeof skill.path === "string" && path37.resolve(skill.path).startsWith(skillsDir + path37.sep);
+  const own = (skill) => typeof skill.path === "string" && path40.resolve(skill.path).startsWith(skillsDir + path40.sep);
   const userSkills = new Set((listed?.data ?? []).filter((skill) => !own(skill)).map((skill) => skill.id));
   const packaged = new Map;
   for (const id of WORKIT_METHOD_SKILLS) {
-    const file = path37.join(skillsDir, id, "SKILL.md");
-    if (!userSkills.has(id) && existsSync12(file))
+    const file = path40.join(skillsDir, id, "SKILL.md");
+    if (!userSkills.has(id) && existsSync13(file))
       packaged.set(id, file);
   }
   await ctx.skill.transform((editor) => {
@@ -24279,7 +24932,7 @@ var registerSkills = async (ctx) => {
     for (const [id, file] of packaged) {
       if (existing.has(id))
         continue;
-      const parsed = parseFrontmatter(readFileSync9(file, "utf8"));
+      const parsed = parseFrontmatter(readFileSync10(file, "utf8"));
       editor.add({
         id,
         name: parsed.name || id,
@@ -24317,25 +24970,25 @@ var registerCommands = async (ctx, registeredSkills) => {
 };
 
 // packages/workit-opencode/src/stale-sources.ts
-import { existsSync as existsSync13, readdirSync as readdirSync6 } from "node:fs";
-import path38 from "node:path";
+import { existsSync as existsSync14, readdirSync as readdirSync6 } from "node:fs";
+import path41 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var typescriptFiles = (directory) => {
-  if (!existsSync13(directory))
+  if (!existsSync14(directory))
     return [];
   return readdirSync6(directory, { withFileTypes: true }).flatMap((entry) => {
-    const file = path38.join(directory, entry.name);
+    const file = path41.join(directory, entry.name);
     return entry.isDirectory() ? typescriptFiles(file) : entry.isFile() && file.endsWith(".ts") ? [file] : [];
   });
 };
 var pluginSourceFiles = [
   ...new Set([
     fileURLToPath3(import.meta.url),
-    ...typescriptFiles(path38.join(packageRoot2(), "src")),
-    path38.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
-    ...typescriptFiles(path38.join(packageRoot2(), "..", "workit-core", "src", "core"))
+    ...typescriptFiles(path41.join(packageRoot2(), "src")),
+    path41.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
+    ...typescriptFiles(path41.join(packageRoot2(), "..", "workit-core", "src", "core"))
   ])
-].filter((file) => existsSync13(file)).toSorted();
+].filter((file) => existsSync14(file)).toSorted();
 
 // packages/workit-opencode/src/v2/plugin.ts
 var sessionFacts = async (ctx, sessionID) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-opencode",
-  "version": "8.14.1",
+  "version": "8.15.1",
   "private": false,
   "description": "Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills",
   "keywords": [
@@ -39,7 +39,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.14.1",
+    "@brainervirus/workit-core": "^8.15.1",
     "@opencode/plugin": "2.0.18"
   },
   "engines": {