@brainervirus/workit-opencode 8.22.3 → 8.23.0

package/assets/skills/workit-fanout/SKILL.md

@@ -20,14 +20,14 @@ units of ~100+ lines each. Coupled work stays with one owner. Workit never spawn
    PR (`references/orchestration.md`).
 2. **Record standing orders** (`workit ledger standing add "<order>"`): every
    user directive all workers share. Directives decay across resumes.
-3. **Brief each worker verbatim** with `workit fanout brief <slice>`: plan
-   fields, standing orders, SCRATCH, session id, fan-in and heavy-lease rules.
+3. **Brief each worker verbatim**: `workit fanout worktree create <slice>`
+   (every host), then `workit fanout brief <slice>` (WORKTREE, SCRATCH, rules).
    Never hand-edit it; change the plan or the standing orders and render again.
 4. **Spawn in a rolling window**, in the background, each in its own worktree:
    keep 4-6 in flight and refill from `spawnable` in `workit fanout status` as
    each one finishes. Model: the brief's `model:` line, else TIER
-   (`references/orchestration.md`). Claude Code: the `implementer` agent;
-   elsewhere first `workit fanout worktree create <slice>`.
+   (`references/orchestration.md`). Claude Code: the `implementer` agent, never
+   with `isolation: "worktree"`; Workit's hooks confine it to its WORKTREE.
 5. **Judge liveness by side effects only:** `workit fanout status` (head age,
    PR, CI, verdict, landed; STUCK past the TIMEBOX). Stop a stuck worker and
    observe that it exited (a timeout is not proof). Removing a worktree drops

package/assets/skills/workit-fanout/references/brief.md

@@ -25,6 +25,7 @@ REPORT: branch, head SHA, files changed, each VERIFY command with its exit code,
   each ACCEPTANCE line met / not met, rulings you made (`workit ledger ruling`),
   anything out of scope as a follow-up, not a diff.
 STANDING: <the standing orders, verbatim: `workit ledger standing add` records each one>
+WORKTREE: <the path `workit fanout worktree create <slice>` made; the worker runs `workit --cwd <it> …` there>
   <identity line, per the lead's host: see "Identity and git rules per host" below>
 ```
 
@@ -48,6 +49,7 @@ FORBIDDEN: no edits outside SCOPE; no schema migration; no new packages
 FAN-IN: one PR per slice. Never rebase, retarget, merge or force-push: the lead owns topology.
 REPORT: as in the template
 STANDING: conventional commits; no comments that restate code; ask nothing, record rulings instead
+WORKTREE: ../app-wt/usage-endpoint  (made by `workit fanout worktree create usage-endpoint`; yours alone)
 ```
 
 ## Plan file
@@ -106,25 +108,29 @@ lead's host (`WORKIT_HOST`, or the host's own session variable):
 
 | Lead's host | Identity line | RULES 1 and 3 |
 | --- | --- | --- |
-| Claude Code | `Session: your env already has WORKIT_SESSION_ID (the lead's id)`; no `export`, no hand-minted id (SubagentStart issues `<lead>:<agent id>` only to verifiers and reviewers, never to an implementer, so the worker's commits carry the lead's id) | plain git: `git fetch origin && git switch -c <branch> origin/<base>` and `git commit -m <msg> --trailer "Workit-Session: <the env WORKIT_SESSION_ID>" --trailer "<host attribution>" -- <paths in SCOPE>`, because worktree isolation refuses every `workit git` form |
+| Claude Code | `Session: your env already has WORKIT_SESSION_ID (the lead's id)`; no `export`, no hand-minted id (SubagentStart issues `<lead>:<agent id>` only to verifiers and reviewers, never to an implementer, so the worker's commits carry the lead's id) | `workit git branch <branch> --base <base>`, `workit git commit -m <msg> -- <paths in SCOPE>`: the implementer runs without Claude Code's worktree isolation, which refused every `workit git` form |
 | OpenCode, Pi, Codex | `Session: your host already sets WORKIT_SESSION_ID in your shell`; export nothing (the host derives the id and an export cannot replace it) | `workit git branch <branch> --base <base>`, `workit git commit -m <msg> -- <paths in SCOPE>` |
 | Cursor, CI, a plain terminal | `export WORKIT_SESSION_ID=<lead>-w-<slice>` (`+try<n>` for a race attempt): declared, not checked | the same `workit git` forms |
 
-`MODE: resume` is `git switch <branch>` on every host (the branch exists; the
-lead removed the dead worker's worktree after its exit, so the switch
-succeeds), then continue from its head. A race attempt (`--attempt <n>`)
-follows its host's row with the branch `<branch>-try<n>`.
+Once `workit fanout worktree create <slice>` made the worktree, the brief's
+WORKTREE line names it and RULES 1 and 3 run against it on every host:
+`workit --cwd <worktree> git commit …`, `workit --cwd <worktree> check <name>`,
+one verb per call. The worktree is already on the branch (MODE new or resume),
+so no branch command comes first. Without one, `MODE: resume` is
+`git switch <branch>` (the branch exists), then continue from its head. A race
+attempt (`--attempt <n>`) follows its host's row with the branch
+`<branch>-try<n>`.
 
 ## Worker rules (`workit fanout brief` appends them as RULES)
 
-1. First command: create the branch (`MODE: new`; the worktree may start on a
-   name that breaks branch policy) or `git switch` to it (`MODE: resume`),
-   as the table above says for your host.
+1. Work only in WORKTREE, already on the branch, one verb per call against it
+   (`workit --cwd <worktree> …`); Workit's hooks deny an implementer's change
+   outside it. With no worktree made yet: create the branch (`MODE: new`) or
+   `git switch` to it (`MODE: resume`), as the table above says.
 2. Decide ambiguities yourself and record them:
    `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`.
    Stop only for an irreversible action, a security-sensitive one, or a side
    effect outside the worktree.
-3. Commit as the table says (`workit git commit -m "<msg>" -- <paths in SCOPE>`,
-   or plain git with the trailers on Claude Code); push only if the brief says
-   so.
+3. Commit with `workit --cwd <worktree> git commit -m "<msg>" -- <paths in SCOPE>`;
+   push only if the brief says so.
 4. Never record a verdict on your own work.

package/assets/skills/workit-fanout/references/orchestration.md

@@ -35,8 +35,8 @@ parent is verified, appears there by itself.
 
 A slice is retried when it is STUCK, its worker exits without meeting
 ACCEPTANCE, or its verdict fails. Stop the worker and observe that it exited.
-Release its worktree: `workit fanout worktree release <slice>` (native
-worktrees: record `git -C <wt> status --short` first). Then spawn one fresh
+Release its worktree: `workit fanout worktree release <slice>` (it records
+`git status` first), and create it again for the retry. Then spawn one fresh
 worker with `workit fanout brief <slice> --mode resume`: same branch, and the
 brief points at its head and its ledger rows (last report, verdicts,
 rulings). If the retry fails too, escalate instead of a third worker:
@@ -69,9 +69,9 @@ list. The fixer applies that list once, then one focused recheck follows.
 When a hard slice has an uncertain approach and a cheap VERIFY, run 2-3
 attempts at once instead of retrying in series. `workit fanout brief <slice>
 --attempt <n>` gives each attempt its own branch (`<branch>-try<n>`), session
-and scratch dir. Each attempt needs its own worktree: Claude Code's
-`implementer` isolates natively; on other hosts `fanout worktree create` makes
-only the slice's own worktree, so run the attempts one after another there.
+and scratch dir. Each attempt needs its own worktree, and `fanout worktree
+create` makes only the slice's own one, so run the attempts one after another
+there on every host.
 Verify every attempt, keep the one with the best verdict (accepted first,
 then the fewest changed files, then the earliest), point the slice branch at
 it (`git branch <branch> <winner>`), have the verifier record the verdict on
@@ -109,7 +109,7 @@ Which session id a verdict carries, per host:
   `WORKIT_SESSION_ID=<lead>:verifier-<random hex>`, a fresh suffix per
   verifier. Cursor cannot check it: it is declared, not derived.
 - A worker's commits: on Claude Code the lead's `WORKIT_SESSION_ID` already in
-  its env (SubagentStart issues no implementer id; plain git, no export, so the
+  its env (SubagentStart issues no implementer id; no export, so the
   lead authored those commits: a verifier or reviewer records the verdict, not
   the lead); on OpenCode, Pi and Codex the id the host already
   puts in its shell; on Cursor, CI and a plain terminal the brief's

package/assets/skills/workit-implement/SKILL.md

@@ -47,6 +47,8 @@ description: Build a requested change in small verified steps - follow local pat
    `workit verify-delivery push`).
 
 Independent slices that could run in parallel: fan them out (call the skill tool with `workit-fanout`).
+One `implementer` slice: `workit fanout worktree create <slice>` before spawning,
+then `workit fanout brief <slice>`; no host isolation (Workit's hooks confine it).
 
 Stay inline by default (workspace `delegation: inline-first`). Hand work off
 only past the thresholds: an explorer after about 3 tool calls or 10k tokens

package/dist/plugin.js

@@ -16219,6 +16219,24 @@ function workitInvocations(command, dialect = "posix", depth = 0) {
   }
   return found;
 }
+var WORKIT_GLOBAL = /^--(?:cwd|session|token|as)(=|$)/;
+function skipWorkitGlobals(args) {
+  let cwd = null;
+  let at = 0;
+  for (;at < args.length; at++) {
+    const match = WORKIT_GLOBAL.exec(args[at]);
+    if (match?.[1] === "=") {
+      if (args[at].startsWith("--cwd="))
+        cwd = args[at].slice(6);
+    } else if (match && args[at + 1] !== undefined) {
+      if (args[at] === "--cwd")
+        cwd = args[at + 1];
+      at++;
+    } else if (args[at] !== "--json")
+      break;
+  }
+  return { rest: args.slice(at), cwd };
+}
 var PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
 var CURRENT_BRANCH = /^\$\(\s*git\s+(?:branch\s+--show-current|rev-parse\s+--abbrev-ref\s+HEAD|symbolic-ref\s+--short\s+HEAD)\s*\)$/;
 var pushDestination = (destination) => {
@@ -21349,7 +21367,7 @@ function heavyGate(cwd, command, options) {
   }
 }
 // packages/workit-core/src/hooks/write-gate.ts
-import { realpathSync as realpathSync6 } from "node:fs";
+import { existsSync as existsSync9, realpathSync as realpathSync6 } from "node:fs";
 import os10 from "node:os";
 import path31 from "node:path";
 
@@ -21578,7 +21596,7 @@ var exempt = (cwd, root, file, plans) => {
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
-var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
+var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs", "busybox"]);
 var operands = (words) => words.filter((item) => !item.startsWith("-"));
 var SCRIPT_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
 var wrappedScript = (input) => {
@@ -21590,9 +21608,9 @@ var wrappedScript = (input) => {
     return null;
   if ("script" in tail)
     return tail.script;
-  const [shell, flag, script] = tail.argv;
-  if (SCRIPT_SHELLS.has((shell.split(/[\\/]/).at(-1) ?? "").toLowerCase()) && /^-[a-z]*c$/.test(flag ?? ""))
-    return script ?? null;
+  const script = shellScript2(tail.argv);
+  if (SCRIPT_SHELLS.has((tail.argv[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase()) && script)
+    return script;
   return tail.argv.map(quoteWord2).join(" ");
 };
 var editsOf = (input) => {
@@ -21671,6 +21689,94 @@ var editsOf = (input) => {
       return [];
   }
 };
+var shellScript2 = (words) => {
+  if (!SCRIPT_SHELLS.has((words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase()))
+    return null;
+  for (let index = 1;index < words.length; index++) {
+    const word = words[index];
+    if (/^-[a-z]*c$/.test(word))
+      return words[index + 1] ?? null;
+    if (/^[-+][oO]$/.test(word))
+      index++;
+    else if (!/^[-+]/.test(word))
+      return null;
+  }
+  return null;
+};
+var XARGS_VALUE = /^-[IinLPdsEa]$/;
+var runsWriter = (words) => {
+  const filled = [...words.filter((word) => word !== "{}" && word !== ";" && word !== "+"), "x"];
+  const edits = editsOf(filled);
+  return edits === null || edits.length > 0 || opaqueWrites(filled) !== null;
+};
+var opaqueWrites = (input) => {
+  let words = input;
+  while (words.length && (PREFIXES2.has(words[0]) || /^\w+=/.test(words[0]))) {
+    if (words[0] === "xargs") {
+      let at = 1;
+      while (words[at]?.startsWith("-"))
+        at += XARGS_VALUE.test(words[at]) ? 2 : 1;
+      return runsWriter(words.slice(at)) ? ["."] : null;
+    }
+    words = words.slice(1);
+  }
+  const [verb, ...args] = words;
+  const name = (verb?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+  const files = operands(args);
+  const has = (pattern) => args.some((arg) => pattern.test(arg));
+  const listed = (named) => named.length ? named : ["."];
+  if (name === "unlink" || name === "shred")
+    return listed(files);
+  if (/^(?:chmod|chown|chgrp|chattr)$/.test(name))
+    return listed(has(/^--reference/) ? files : files.slice(1));
+  if (name === "rsync") {
+    const dest = files.at(-1);
+    const remote = /^[\w.@-]*:/.test(dest ?? "") && !/^[A-Za-z]:[\\/]/.test(dest ?? "");
+    return dest === undefined ? ["."] : remote ? [] : [dest];
+  }
+  if (name === "find") {
+    const exec = args.findIndex((arg) => /^-(?:exec|execdir|ok|okdir)$/.test(arg));
+    const writes = has(/^-(?:delete|fprint\w*|fls)$/) || exec >= 0 && runsWriter(args.slice(exec + 1));
+    const end = args.findIndex((arg) => /^[-(!]/.test(arg));
+    return writes ? listed(end < 0 ? args : args.slice(0, end)) : null;
+  }
+  if (/^g?awk$/.test(name)) {
+    if (!has(/^-i|^--include/))
+      return null;
+    const named = [];
+    let program = !has(/^-f$|^--file/);
+    for (let index = 0;index < args.length; index++)
+      if (/^(?:-[ifvF]|--(?:include|file|assign|field-separator))$/.test(args[index]))
+        index++;
+      else if (args[index].startsWith("-"))
+        continue;
+      else if (program)
+        program = false;
+      else
+        named.push(args[index]);
+    return listed(named);
+  }
+  if (name === "perl")
+    return has(/^-[a-zA-Z]*[eE]/) ? ["."] : null;
+  if (/^(?:python[\d.]*|node|bun|deno|ruby|php)$/.test(name))
+    return has(/^-[a-zA-Z]*[ce]$|^--eval$|^-p$/) ? ["."] : null;
+  return shellScript2(words) === null ? null : ["."];
+};
+var linkSources = (args, at) => {
+  const names = operands([...args]);
+  const into = args.indexOf("-t");
+  const dest = into >= 0 ? args[into + 1] : names.length > 1 ? names.at(-1) : ".";
+  const sources = names.filter((name, index) => into >= 0 ? name !== dest : index < names.length - 1 || names.length === 1);
+  const target = dest === undefined ? null : at(dest);
+  const symbolic = args.some((arg) => /^-[a-zA-Z]*s|^--symbolic$/.test(arg));
+  const base = target === null ? null : into >= 0 || sources.length > 1 || existsSync9(target) || /[\\/]$/.test(dest ?? "") ? target : path31.dirname(target);
+  return sources.flatMap((source) => {
+    if (symbolic && base !== null && !path31.isAbsolute(homeExpanded(source)))
+      return [path31.resolve(base, source)];
+    const resolved = at(source);
+    return resolved ? [resolved] : [];
+  });
+};
 var shellWrites = (command, depth = 0) => {
   const targets = [];
   let unknown = false;
@@ -21780,11 +21886,15 @@ var gitMutationDirs = (cwd, command, dialect) => {
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
 var PUSHD2 = new Set(["pushd", "push-location"]);
 var POPD2 = new Set(["popd", "pop-location"]);
-var cdInto = (dir, words) => {
+var UNKNOWN_DIR = path31.resolve(path31.parse(process.cwd()).root, ".workit-unknown-dir");
+var cdInto = (dir, words, strict = false) => {
+  const lost = strict ? UNKNOWN_DIR : undefined;
   const named = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
   const target = named === undefined ? undefined : homeExpanded(named);
-  if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
-    return;
+  if (target === "-" || target && /^~|[$`*?]/.test(target))
+    return lost;
+  if (dir === undefined)
+    return lost;
   return target === undefined ? os10.homedir() : path31.resolve(dir, target);
 };
 var quoteWord2 = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
@@ -21792,7 +21902,7 @@ var homeExpanded = (file) => {
   const match = /^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/.exec(file);
   return match ? (process.env.HOME || os10.homedir()) + file.slice(match[0].length) : file;
 };
-var segmentTargets = (cwd, command, dialect, depth = 0) => {
+var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
   const targets = [];
   let dir = cwd;
   let stack = [];
@@ -21816,21 +21926,35 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
     const words = lead < 0 ? [] : segment.words.slice(lead);
     const name = (words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
     if (CD2.has(name)) {
-      dir = cdInto(dir, words);
+      dir = cdInto(dir, words, strict);
       continue;
     }
     if (PUSHD2.has(name)) {
       stack.push(dir);
-      dir = cdInto(dir, words);
+      dir = cdInto(dir, words, strict);
       continue;
     }
     if (POPD2.has(name)) {
-      dir = stack.length ? stack.pop() : undefined;
+      dir = stack.length ? stack.pop() : strict ? UNKNOWN_DIR : undefined;
       continue;
     }
-    const inner = depth < 4 ? wrappedScript(words) : null;
+    const inner = depth < 4 ? wrappedScript(words) ?? (strict ? shellScript2(words) : null) : null;
     if (inner !== null && dir !== undefined)
-      targets.push(...segmentTargets(dir, inner, "posix", depth + 1));
+      targets.push(...segmentTargets(dir, inner, "posix", depth + 1, strict));
+    if (strict && dir !== undefined) {
+      const runIn = dir;
+      for (const sub of depth < 4 ? segment.subs ?? [] : [])
+        targets.push(...segmentTargets(runIn, sub, dialect, depth + 1, true));
+      const opaque = segment.unanalyzable ? ["."] : inner === null ? opaqueWrites(words) : null;
+      for (const file of opaque ?? []) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(file === "." ? path31.join(resolved, DIR_TARGET) : resolved);
+      }
+      const ln = words.findIndex((word) => /^ln$/i.test(word.split(/[\\/]/).at(-1) ?? ""));
+      if (ln >= 0 && words.slice(0, ln).every((word) => PREFIXES2.has(word)))
+        targets.push(...linkSources(words.slice(ln + 1), at));
+    }
     for (const file of segment.redirects)
       if (!/^\/dev\/(?:null|stdout|stderr|tty)$/.test(file)) {
         const resolved = at(file);
@@ -21847,11 +21971,29 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
         if (resolved)
           targets.push(resolved);
       }
-    if (dir !== undefined && workitInvocations(segment.words.map(quoteWord2).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
-      targets.push(path31.join(dir, DIR_TARGET));
+    if (dir !== undefined)
+      for (const invocation of workitInvocations(segment.words.map(quoteWord2).join(" "), "posix")) {
+        const { at: runsIn, args } = workitCwd(dir, invocation);
+        if (args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), ""))
+          targets.push(path31.join(runsIn, DIR_TARGET));
+      }
   }
   return targets;
 };
+var workitCwd = (dir, args) => {
+  const { rest, cwd } = skipWorkitGlobals(args);
+  return { at: cwd === null ? dir : path31.resolve(dir, homeExpanded(cwd)), args: rest };
+};
+var shellMutationTargets = (cwd, command, dialect = "posix", strict = false) => {
+  try {
+    return [
+      ...segmentTargets(cwd, command, dialect, 0, strict),
+      ...gitMutationDirs(cwd, command, dialect).map((dir) => path31.join(dir, DIR_TARGET))
+    ];
+  } catch {
+    return [];
+  }
+};
 var overridden = (command, dialect) => {
   const segments = segmentsOf(command, dialect);
   if (segments.length !== 1 || segments[0].group || segments[0].subs?.length)
@@ -21957,16 +22099,8 @@ function shellGate(cwd, command, owner, dialect = "posix", deps) {
   } catch {}
   const writes = shellWrites(command);
   let targets = [];
-  if (owner) {
-    try {
-      targets = [
-        ...segmentTargets(cwd, command, dialect),
-        ...gitMutationDirs(cwd, command, dialect).map((dir) => path31.join(dir, DIR_TARGET))
-      ];
-    } catch {
-      targets = [];
-    }
-  }
+  if (owner)
+    targets = shellMutationTargets(cwd, command, dialect);
   if (owner && targets.length) {
     const live = liveGate(owner, targets, deps);
     if (live.kind !== "none") {
@@ -22544,6 +22678,19 @@ var standingSinceStart = (input) => {
 // packages/workit-core/src/hooks/cwd-normalize.ts
 var FILTERS = new Set(["tail", "head", "grep"]);
 
+// packages/workit-core/src/hooks/worktree-confine.ts
+var CASE_INSENSITIVE2 = process.platform === "darwin" || process.platform === "win32";
+var MUTATING_REMOTE = new Set([
+  "add",
+  "remove",
+  "rm",
+  "rename",
+  "set-url",
+  "set-head",
+  "set-branches",
+  "prune"
+]);
+
 // packages/workit-core/src/hooks/handle.ts
 var offered = new Set;
 var PRE_TOOL = new Set(["shell.pre", "write.pre", "tool.pre"]);
@@ -22652,7 +22799,7 @@ var OPENCODE_DESCRIPTOR = {
 import path37 from "node:path";
 
 // packages/workit-core/src/core/gitignore.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
 import path33 from "node:path";
 var GITIGNORE_ENTRIES = [
   "# workit: SDD working state (never commit)",
@@ -22674,7 +22821,7 @@ var ensureProjectGitignore = (workspaceRoot, confirmed) => {
   if (!confirmed)
     return { ok: false, error: "confirmed: true required" };
   const file = path33.join(workspaceRoot, ".gitignore");
-  const existing = existsSync9(file) ? readFileSync6(file, "utf8") : "";
+  const existing = existsSync10(file) ? readFileSync6(file, "utf8") : "";
   const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
   const added = [];
@@ -22693,19 +22840,19 @@ var ensureProjectGitignore = (workspaceRoot, confirmed) => {
 ` : "") + append.join(`
 `) + `
 `, "utf8");
-  } else if (!existsSync9(file)) {
+  } else if (!existsSync10(file)) {
     writeFileSync4(file, "", "utf8");
   }
   return { ok: true, path: file, added };
 };
 
 // packages/workit-core/src/core/hygiene.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync7, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import path34 from "node:path";
 var repoRoot3 = assetRoot();
 var templatesDir = () => path34.join(repoRoot3, "templates", "hygiene");
 var packageJson = (root) => {
-  if (!existsSync10(path34.join(root, "package.json")))
+  if (!existsSync11(path34.join(root, "package.json")))
     return null;
   try {
     return JSON.parse(readFileSync7(path34.join(root, "package.json"), "utf8"));
@@ -22714,7 +22861,7 @@ var packageJson = (root) => {
   }
 };
 var isOpenSource = (root) => {
-  if (existsSync10(path34.join(root, "LICENSE")))
+  if (existsSync11(path34.join(root, "LICENSE")))
     return true;
   const pkg = packageJson(root);
   if (pkg && !pkg.private)
@@ -22742,10 +22889,10 @@ var planHygieneFiles = (root, opts = {}) => {
     files.push("LICENSE", "CONTRIBUTING.md");
   const planned = [];
   for (const file of files) {
-    if (existsSync10(path34.join(root, file)))
+    if (existsSync11(path34.join(root, file)))
       continue;
     const tpl = path34.join(templatesDir(), file);
-    if (!existsSync10(tpl))
+    if (!existsSync11(tpl))
       continue;
     const content = readFileSync7(tpl, "utf8").replace(/<PROJECT>/g, path34.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
     planned.push({ path: path34.join(root, file), content });
@@ -23290,7 +23437,7 @@ import path41 from "node:path";
 
 // packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
 import path40 from "node:path";
 
 // packages/workit-core/src/forge/redact.ts
@@ -23339,11 +23486,11 @@ function operationInProgress(cwd) {
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
-    if (!marker || !existsSync11(marker))
+    if (!marker || !existsSync12(marker))
       continue;
-    if (index === 1 && existsSync11(path40.join(marker, "applying")))
+    if (index === 1 && existsSync12(path40.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync11(path40.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync12(path40.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
         headName = readFileSync9(path40.join(marker, "head-name"), "utf8").trim();
@@ -24638,11 +24785,11 @@ var createStopControl = (root, port) => {
 };
 
 // packages/workit-opencode/src/v2/registry.ts
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
 import path45 from "node:path";
 
 // packages/workit-opencode/src/shared/assets.ts
-import { existsSync as existsSync12, realpathSync as realpathSync9 } from "node:fs";
+import { existsSync as existsSync13, realpathSync as realpathSync9 } from "node:fs";
 import path44 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleDir = () => {
@@ -24659,7 +24806,7 @@ var packageRoot2 = () => {
     path44.resolve(dir, "..", ".."),
     path44.resolve(dir, "..", "..", "..")
   ]) {
-    if (existsSync12(path44.join(candidate, "package.json")))
+    if (existsSync13(path44.join(candidate, "package.json")))
       return candidate;
   }
   return path44.resolve(dir, "..");
@@ -24667,7 +24814,7 @@ var packageRoot2 = () => {
 var skillsRoot = () => {
   const root = packageRoot2();
   const canonical = path44.resolve(root, "..", "workit-core", "skills");
-  if (existsSync12(path44.join(root, "src")) && existsSync12(canonical))
+  if (existsSync13(path44.join(root, "src")) && existsSync13(canonical))
     return canonical;
   return path44.join(root, "assets", "skills");
 };
@@ -24693,7 +24840,7 @@ var parseFrontmatter = (markdown) => {
 };
 var registerSkills = async (ctx) => {
   const skillsDir = skillsRoot();
-  if (!existsSync13(skillsDir))
+  if (!existsSync14(skillsDir))
     return new Set;
   const listed = await ctx.skill.list().catch(() => ({ data: [] }));
   const own = (skill) => typeof skill.path === "string" && path45.resolve(skill.path).startsWith(skillsDir + path45.sep);
@@ -24701,7 +24848,7 @@ var registerSkills = async (ctx) => {
   const packaged = new Map;
   for (const id of WORKIT_METHOD_SKILLS) {
     const file = path45.join(skillsDir, id, "SKILL.md");
-    if (!userSkills.has(id) && existsSync13(file))
+    if (!userSkills.has(id) && existsSync14(file))
       packaged.set(id, file);
   }
   await ctx.skill.transform((editor) => {
@@ -24747,11 +24894,11 @@ var registerCommands = async (ctx, registeredSkills) => {
 };
 
 // packages/workit-opencode/src/stale-sources.ts
-import { existsSync as existsSync14, readdirSync as readdirSync6 } from "node:fs";
+import { existsSync as existsSync15, readdirSync as readdirSync6 } from "node:fs";
 import path46 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var typescriptFiles = (directory) => {
-  if (!existsSync14(directory))
+  if (!existsSync15(directory))
     return [];
   return readdirSync6(directory, { withFileTypes: true }).flatMap((entry) => {
     const file = path46.join(directory, entry.name);
@@ -24765,7 +24912,7 @@ var pluginSourceFiles = [
     path46.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
     ...typescriptFiles(path46.join(packageRoot2(), "..", "workit-core", "src", "core"))
   ])
-].filter((file) => existsSync14(file)).toSorted();
+].filter((file) => existsSync15(file)).toSorted();
 
 // packages/workit-opencode/src/v2/plugin.ts
 var sessionFacts = async (ctx, sessionID) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-opencode",
-  "version": "8.22.3",
+  "version": "8.23.0",
   "private": false,
   "description": "Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills",
   "keywords": [
@@ -39,7 +39,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.22.3",
+    "@brainervirus/workit-core": "^8.23.0",
     "@opencode/plugin": "2.0.18"
   },
   "engines": {